diff options
Diffstat (limited to 'CHANGES.0')
| -rw-r--r-- | CHANGES.0 | 18002 |
1 files changed, 0 insertions, 18002 deletions
diff --git a/CHANGES.0 b/CHANGES.0 deleted file mode 100644 index a73130fc2..000000000 --- a/CHANGES.0 +++ /dev/null @@ -1,18002 +0,0 @@ - _ _ ____ _ - ___| | | | _ \| | - / __| | | | |_) | | - | (__| |_| | _ <| |___ - \___|\___/|_| \_\_____| - - Old Changelog - -Changes done to curl and libcurl from 1997 to 2010, edited manually. The most -recent changes are always generated into the CHANGES file straight from git. - -Kamil Dudka (17 June 2010) -- Improve test575 in order to not fail with threaded DNS resolver. - -Version 7.21.0 (16 June 2010) - -Daniel Stenberg (5 June 2010) -- Constantine Sapuntzakis fixed a case of spurious SSL connection aborts using - libcurl and OpenSSL. "I tracked it down to uncleared error state on the - OpenSSL error stack - patch attached deals with that." - -Daniel Stenberg (5 June 2010) -- Frank Meier added CURLINFO_PRIMARY_PORT, CURLINFO_LOCAL_IP and - CURLINFO_LOCAL_PORT to curl_easy_getinfo(). - -Yang Tse (4 June 2010) -- Enabled OpenLDAP support for cygwin builds. This support was disabled back - in 2008 due to incompatibilities between OpenSSL and OpenLDAP headers. - cygwin's OpenSSL 0.9.8l and OpenLDAP 2.3.43 versions on cygwin 1.5.25 - allow building an OpenLDAP enabled libcurl supporting back to Windows 95. - - Removed the non-functional CURL_LDAP_HYBRID code and references. - -Daniel Stenberg (2 June 2010) -- Jason McDonald posted bug report #3006786 when he found that the SFTP code - didn't timeout properly in several places in the code even if a timeout was - set properly. - - Based on his suggested patch, I wrote a different implementation that I - think addressed the issue better and also uses the connect timeout for the - initial part of the SSH/SFTP done during the "protocol connect" phase. - - (https://curl.haxx.se/bug/view.cgi?id=3006786) - -Yang Tse (2 June 2010) -- Added missing new libcurl files to non-configure targets. Adjusted - libcurl standard internal header inclusions in new files. Fixed an - SPNEGO related memory leak. Fixed several LDAP related compilation - issues, and fixed some compiler warnings. - -Daniel Stenberg (1 June 2010) -- Igor Novoseltsev reported a problem with the multi socket API and using - timeouts and timers. It boiled down to a problem with libcurl's use of - GetTickCount() interally to figure out the current time, while Igor's own - application code used another function call. - - It made his app call the socket API timeout function a bit _before_ libcurl - would consider the timeout to trigger, and that could easily lead to - timeouts or stalls in the app. It seems GetTickCount() in general often has - no better resolution than 16ms and switching to the alternative function - QueryPerformanceCounter has its share of problems: - http://www.virtualdub.org/blog/pivot/entry.php?id=106 - - We address this problem by simply having libcurl treat timers that already - has occured or will occur within 40ms subject for treatment. I'm confident - that there are other implementations and operating systems with similarly in - accurate timer functions so it makes sense to have applied generically and I - don't believe we sacrifice much by adding a 40ms inaccuracy on these - timeouts. - -Kamil Dudka (27 May 2010) -- added a new test for CRL support (test313) - -- Tor Arntsen changed the alternative definition of bool to use enum instead - of unsigned char. - -Daniel Stenberg (25 May 2010) -- Julien Chaffraix fixed the warning seen when compiling lib/rtmp.c: one - unused variables, several unused arguments and some missing #include. - -- Julien Chaffraix fixed 2 OOM errors: a missing NULL-check in - lib/http_negociate.c and a potential NULL dereferencing in lib/splay.c - -- Howard Chu brought a patch that makes the LDAP code much cleaner, nicer and - in general being a better libcurl citizen. If a new enough OpenLDAP version - is detect, the new and shiny lib/openldap.c code is then used instead of the - old cruft. - -Daniel Stenberg (21 May 2010) -- Eric Mertens posted bug #3003705: when we made TFTP use the correct timeout - option when sent to the server (fixed May 18th 2010) it became obvious that - libcurl used invalid timeout values (300 by default while the RFC allows - nothing above 255). While of course it is obvious that as TFTP has worked - thus far without being able to set timeout at all, just removing the setting - wouldn't make any difference in behavior. I decided to still keep it (but - fix the problem) as it now actually allows for easier (future) customization - of the timeout. - - (https://curl.haxx.se/bug/view.cgi?id=3003705) - -- Douglas Kilpatrick filed bug report #3004787 and pointed out that the TFTP - code didn't handle block id wraps correctly. His suggested fix inspired the - fix I committed. - - (https://curl.haxx.se/bug/view.cgi?id=3004787) - -Daniel Stenberg (20 May 2010) -- Tanguy Fautre brought a fix to allow curl to build with Microsoft VC10. - -Daniel Stenberg (18 May 2010) -- Eric Mertens posted bug report #3003005 pointing out that the libcurl TFTP - code was not sending the timeout option properly to the server, and - suggested a fix. - - (https://curl.haxx.se/bug/view.cgi?id=3003005) - -Kamil Dudka (16 May 2010) -- Pavel Raiskup introduced a new option CURLOPT_FNMATCH_DATA in order to pass - a custom data pointer to the callback specified by CURLOPT_FNMATCH_FUNCTION. - -Daniel Stenberg (14 May 2010) -- John-Mark Bell filed bug #3000052 that identified a problem (with an - associated patch) with the OpenSSL handshake state machine when the multi - interface is used: - - Performing an https request using a curl multi handle and using select or - epoll to wait for events results in a hang. It appears that the cause is the - fix for bug #2958179, which makes ossl_connect_common unconditionally return - from the step 2 loop when fetching from a multi handle. - - When ossl_connect_step2 has completed, it updates connssl->connecting_state - to ssl_connect_3. ossl_connect_common will then return to the caller, as a - multi handle is in use. Eventually, the client code will call - curl_multi_fdset to obtain an updated fdset to select or epoll on. For https - requests, curl_multi_fdset will cause https_getsock to be called. - https_getsock will only return a socket handle if the connecting_state is - ssl_connect_2_reading or ssl_connect_2_writing. Therefore, the client will - never obtain a valid fdset, and thus not drive the multi handle, resulting - in a hang. - - (https://curl.haxx.se/bug/view.cgi?id=3000052) - -- Sebastian V reported bug #3000056 identifying a problem with redirect - following. It showed that when curl followed redirects it didn't properly - ignore the response body of the 30X response if that response was using - compressed Content-Encoding! - - (https://curl.haxx.se/bug/view.cgi?id=3000056) - -Daniel Stenberg (12 May 2010) -- Howard Chu brought support for RTMP. This is powered by the underlying - librtmp library. It supports a range of variations and "sub-protocols" - within the RTMP family. - -- Pavel Raiskup brought support for FTP directory wildcard matching to allow - selective downloading. To provide that, a set of new options were added: - - CURLOPT_WILDCARDMATCH - CURLOPT_CHUNK_BGN_FUNCTION - CURLOPT_CHUNK_END_FUNCTION - CURLOPT_CHUNK_DATA - CURLOPT_FNMATCH_FUNCTION - - There were also a set of new tests added (574 - 577) to verify this. - -Kamil Dudka (11 May 2010) -- CRL support in libcurl-NSS has been completely broken. Now it works. Original - bug report: https://bugzilla.redhat.com/581926 - -Daniel Stenberg (7 May 2010) -- Dirk Manske reported a regression. When connecting with the multi interface, - there were situations where libcurl wouldn't store connect time correctly as - it used to (and is documented to) do. - - Using his fine sample program we could repeat it, and I wrote up test case - 573 using that code. The problem does not easily show itself using the local - test suite though. - - The fix, also as suggested by Dirk, is a bit on the ugly side as it adds yet - another call to Curl_verboseconnect() and setting the TIMER_CONNECT time. - That situation is subject for some closer inspection in the future. - -- Howard Chu split the I/O handling functions into private handlers. - - Howard Chu brought the bulk work of this patch that properly moves out the - sending and recving of data to the parts of the code that are properly - responsible for the various ways of doing so. - - Daniel Stenberg assisted with polishing a few bits and fixed some minor - flaws in the original patch. - - Another upside of this patch is that we now abuse CURLcodes less with the - "magic" -1 return codes and instead use CURLE_AGAIN more consistently. - -Daniel Stenberg (5 May 2010) -- Hoi-Ho Chan introduced support for using the PolarSSL library. You control - this with the new configure option --with-polarssl. - -Daniel Stenberg (29 Apr 2010) -- Ben Greear made telnet a lot better/easier to use by an application: - - The main change is to allow input from user-specified methods, when they are - specified with CURLOPT_READFUNCTION. All calls to fflush(stdout) in - telnet.c were removed, which makes using 'curl telnet://foo.com' painful - since prompts and other data are not always returned to the user promptly. - Use 'curl --no-buffer telnet://foo.com' instead. In general, the user - should have their CURLOPT_WRITEFUNCTION do a fflush for interactive use. - - Also fix assumption that reading from stdin never returns < 0. - Old code could crash in that case. - - Call progress functions in telnet main loop. - -Daniel Stenberg (26 Apr 2010) -- Make use of the libssh2_init/exit functions that libssh2 added in version - 1.2.5. Using them will improve how libcurl works in threaded situations when - SCP and SFTP are transfered. - -Daniel Stenberg (25 Apr 2010) -- Based on work by Kamil Dudka, I've introduced the new configure option - --enable-threaded-resolver. When used, the configure script will check for - pthreads and if around, it will build libcurl to use pthreads to do name - resolving in a threaded manner. Note that this is just a fix to offer an - option that can enable the code that already included. The threader resolver - code was mostly added on Jan 26 2010. - -Daniel Stenberg (24 Apr 2010) -- Alex Bligh introduced the --proto and -proto-redir options that limit what - protocols curl accepts for the requests and when following redirects. - -Kamil Dudka (24 Apr 2010) -- Fixed test536 in order to not fail with threaded DNS resolver and tweaked - comments in certain examples using curl_multi_fdset(). - -- Fixed SSL handshake timeout underflow in libcurl-NSS, which caused test405 - to hang on a slow machine. - -Daniel Stenberg (21 Apr 2010) -- The -O option caused curl to crash on windows and DOS due to the tool - writing out of boundary memory. - -Yang Tse (20 Apr 2010) -- Ruslan Gazizov detected that MSVC makefiles were using wsock32.lib instead - of ws2_32.lib, this generated linking issues on MSVC IPv6 enabled builds - that were done using those makefiles. - -Daniel Stenberg (19 Apr 2010) -- -J/--remote-header-name didn't strip trailing carriage returns or linefeeds - properly, so they could be used in the file name. - -Daniel Stenberg (16 Apr 2010) -- Jerome Vouillon made the GnuTLS SSL handshake phase non-blocking. - -- The recent overhaul of the SSL recv function made the GnuTLS specific code - treat a zero returned from gnutls_record_recv() as an error, and this caused - our HTTPS test cases to fail. We leave it to upper layer code to detect if - an EOF is a problem or not. - -- I reverted the resolver fix from yesterday and instead removed all uses of - AI_CANONNAME all over libcurl and made the only user of that info (krb5.c) - use the host name from the URL instead. No reverse resolving is a good - thing. - -- Paul Howarth made configure properly detect GSS "on ancient Linux distros" - by editing in which order we use headers to detect GSS. - -Daniel Stenberg (15 Apr 2010) -- Rainer Canavan filed bug report #2987196 that identified libcurl doing - unnecesary reverse name lookups in many cases when built to use IPv4 and - getaddrinfo(). The logic for IPv6 is now used for IPv4 too. - - (https://curl.haxx.se/bug/view.cgi?id=2963679) - -Version 7.20.1 (14 April 2010) - -Daniel Stenberg (9 Apr 2010) -- Prefixing the FTP quote commands with an asterisk really only worked for the - postquote actions. This is now fixed and test case 227 has been extended to - verify. - -Kamil Dudka (4 Apr 2010) -- Eliminated a race condition in Curl_resolv_timeout(). - -- Refactorized interface of Curl_ssl_recv()/Curl_ssl_send(). - -- libcurl-NSS now provides more accurate messages and error codes in case of - client certificate problem. Either during connection, or transfer phase. - -Daniel Stenberg (1 Apr 2010) -- Matt Wixson found and fixed a bug in the SCP/SFTP area where the code - treated a 0 return code from libssh2 to be the same as EAGAIN while in - reality it isn't. The problem caused a hang in SFTP transfers from a - MessageWay server. - -Daniel Stenberg (28 Mar 2010) -- Ben Greear: If you pass a URL to pop3 that does not contain a message ID as - part of the URL, it would previously ask for 'INBOX' which just causes the - pop3 server to return an error. - - Now libcurl treats en empty message ID as a request for LIST (list of pop3 - message IDs). User's code could then parse this and download individual - messages as desired. - -Daniel Stenberg (27 Mar 2010) -- Ben Greear brought a patch that from now on allows all protocols to specify - name and user within the URL, in the same manner HTTP and FTP have been - allowed to in the past - although far from all of the libcurl supported - protocls actually have that feature in their URL definition spec. - -Daniel Stenberg (26 Mar 2010) -- Ben Greear brought code that makes the rate limiting code for the easy - interface a bit smoother as it introduces sub-second sleeps during it and it - also takes the buffer sizes into account. - -Daniel Stenberg (24 Mar 2010) -- Bob Richmond: There's an annoying situation where libcurl will read new HTTP - response data from a socket, then check if it's a timeout if one is set. If - the last packet received constitutes the end of the response body, libcurl - still treats it as a timeout condition and reports a message like: - - "Operation timed out after 3000 milliseconds with 876 out of 876 bytes - received" - - It should only a timeout if the timer lapsed and we DIDN'T receive the end - of the response body yet. - -- Christopher Conroy fixed a problem with RTSP and GET_PARAMETER reported - to us by Massimo Callegari. There's a new test case 572 that verifies this - now. - -- The 'ares' subtree has been removed from the source repository. It was - always a separate project that sort of piggybacked on the curl project since - the dawn of times and now the time has come for it to go stand on its own - legs and continue living its own life. All details on c-ares and its new - source code repository is found at http://c-ares.haxx.se/ - -Daniel Stenberg (23 Mar 2010) -- Kenny To filed the bug report #2963679 with patch to fix a problem he - experienced with doing multi interface HTTP POST over a proxy using - PROXYTUNNEL. He found a case where it would connect fine but bits.tcpconnect - was not set correct so libcurl didn't work properly. - - (https://curl.haxx.se/bug/view.cgi?id=2963679) - -- Akos Pasztory filed debian bug report #572276 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572276 mentioning a problem - with a resource that returns chunked-encoded _and_ with a Content-Length - and libcurl failed to properly ignore the latter information. - -- Hauke Duden provided an example program that made the multi interface crash. - His example simply used the multi interface and did first one FTP transfer - and after completion it used a second easy handle and did another FTP - transfer on the same FTP server. - - This triggered a bug in the "delayed easy handle kill" system that curl - uses: when an FTP connection is left alive it must keep an easy handle - around internally - only for the purpose of having an easy handle when it - later disconnects it. The code assumed that when the easy handle was removed - and an internal reference was made, that version could be killed later on - when a new easy handle came using the same connection. This was wrong as - Hauke's example showed that the removed handle wasn't killed for real until - later. This caused a double close attempt => segfault. - -Daniel Stenberg (22 Mar 2010) -- Thomas Lopatic fixed the alarm()-based DNS timeout: - - Looking at the code of Curl_resolv_timeout() in hostip.c, I think that in - case of a timeout, the signal handler for SIGALRM never gets removed. I - think that in my case it gets executed at some point later on when execution - has long left Curl_resolv_timeout() or even the cURL library. - - The code that is jumped to with siglongjmp() simply sets the error message - to "name lookup timed out" and then returns with CURLRESOLV_ERROR. I guess - that instead of simply returning without cleaning up, the code should have a - goto that jumps to the spot right after the call to Curl_resolv(). - -Kamil Dudka (22 Mar 2010) -- Douglas Steinwand contributed a patch fixing insufficient initialization in - Curl_clone_ssl_config() - -Daniel Stenberg (21 Mar 2010) -- Ben Greear improved TFTP: the error code returning and the treatment - of TSIZE == 0 when uploading. - -- We've switched from CVS to git. See https://curl.haxx.se/source.html - -Kamil Dudka (19 Mar 2010) -- Improved Curl_read() to not ignore the error returned from Curl_ssl_recv(). - -Daniel Stenberg (15 Mar 2010) -- Constantine Sapuntzakis brought a patch: - - The problem mentioned on Dec 10 2009 - (https://curl.haxx.se/bug/view.cgi?id=2905220) was only partially fixed. - Partially because an easy handle can be associated with many connections in - the cache (e.g. if there is a redirect during the lifetime of the easy - handle). The previous patch only cleaned up the first one. The new fix now - removes the easy handle from all connections, not just the first one. - -Daniel Stenberg (6 Mar 2010) -- Ben Greear brought a patch that fixed the rate limiting logic for TFTP when - the easy interface was used. - -Daniel Stenberg (5 Mar 2010) -- Daniel Johnson provided fixes for building curl with the clang compiler. - -Yang Tse (5 Mar 2010) -- Constantine Sapuntzakis detected and fixed a double free in builds done - with threaded resolver enabled (Windows default configuration) that would - get triggered when a curl handle is closed while doing DNS resolution. - -Daniel Stenberg (2 Mar 2010) -- [Daniel Johnson] I've been trying to build libcurl with clang on Darwin and - ran into some issues with the GSSAPI tests in configure.ac. The tests first - try to determine the include dirs and libs and set CPPFLAGS and LIBS - accordingly. It then checks for the headers and finally sets LIBS a second - time, causing the libs to be included twice. The first setting of LIBS seems - redundant and should be left out, since the first part is otherwise just - about finding headers. - - My second issue is that 'krb5-config --libs gssapi' on Darwin is less than - useless and returns junk that, while it happens to work with gcc, causes - clang to choke. For example, --libs returns $CFLAGS along with the libs, - which is really retarded. Simply setting 'LIBS="$LIBS -lgssapi_krb5 - -lresolv"' on Darwin is sufficient. - -- Based on patch provided by Jacob Moshenko, the transfer logic now properly - makes sure that when using sub-second timeouts, there's no final bad 1000ms - wait. Previously, a sub-second timeout would often make the elapsed time end - up the time rounded up to the nearest second (e.g. 1s for 200ms timeout) - -- Andrei Benea filed bug report #2956698 and pointed out that the - CURLOPT_CERTINFO feature leaked memory due to a missing OpenSSL function - call. He provided the patch to fix it too. - - https://curl.haxx.se/bug/view.cgi?id=2956698 - -- Markus Duft pointed out in bug #2961796 that even though Interix has a - poll() function it doesn't quite work the way we want it so we must disable - it, and he also provided a patch for it. - - https://curl.haxx.se/bug/view.cgi?id=2961796 - -- Made the pingpong timeout code properly deal with the response timeout AND - the global timeout if set. Also, as was reported in the bug report #2956437 - by Ryan Chan, the time stamp to use as basis for the per command timeout was - not set properly in the DONE phase for FTP (and not for SMTP) so I fixed - that just now. This was a regression compared to 7.19.7 due to the - conversion of FTP code over to the generic pingpong concepts. - - https://curl.haxx.se/bug/view.cgi?id=2956437 - -Daniel Stenberg (1 Mar 2010) -- Ben Greear provided an update for TFTP that fixes upload. - -- Wesley Miaw reported bug #2958179 which identified a case of looping during - OpenSSL based SSL handshaking even though the multi interface was used and - there was no good reason for it. - - https://curl.haxx.se/bug/view.cgi?id=2958179 - -Daniel Stenberg (26 Feb 2010) -- Pat Ray in bug #2958474 pointed out an off-by-one case when receiving a - chunked-encoding trailer. - - https://curl.haxx.se/bug/view.cgi?id=2958474 - -Daniel Fandrich (25 Feb 2010) -- Fixed a couple of out of memory leaks and a segfault in the SMTP & IMAP code. - -Yang Tse (25 Feb 2010) -- I fixed bug report #2958074 indicating - (https://curl.haxx.se/bug/view.cgi?id=2958074) that curl on Windows with - option --trace-time did not use local time when timestamping trace lines. - This could also happen on other systems depending on time souurce. - -Patrick Monnerat (22 Feb 2010) -- Proper handling of STARTTLS on SMTP, taking CURLUSESSL_TRY into account. -- SMTP falls back to RFC821 HELO when EHLO fails (and SSL is not required). -- Use of true local host name (i.e.: via gethostname()) when available, as - default argument to SMTP HELO/EHLO. -- Test case 804 for HELO fallback. - -Daniel Stenberg (20 Feb 2010) -- Fixed the SMTP compliance by making sure RCPT TO addresses are specified - properly in angle brackets. Recipients provided with CURLOPT_MAIL_RCPT now - get angle bracket wrapping automatically by libcurl unless the recipient - starts with an angle bracket as then the app is assumed to deal with that - properly on its own. - -- I made the SMTP code expect a 250 response back from the server after the - full DATA has been sent, and I modified the test SMTP server to also send - that response. As usual, the DONE operation that is made after a completed - transfer is still not doable in a non-blocking way so this waiting for 250 - is unfortunately made blockingly. - -Yang Tse (14 Feb 2010) -- Overhauled test suite getpart() function. Fixing potential out of bounds - stack and memory overwrites triggered with huge test case definitions. - -Daniel Stenberg (13 Feb 2010) -- Martin Hager reported and fixed a problem with a missing quote in libcurl.m4 - - (https://curl.haxx.se/bug/view.cgi?id=2951319) - -- Tom Donovan fixed the CURL_FORMAT_* defines when building with cmake. - - (https://curl.haxx.se/bug/view.cgi?id=2951269) - -Daniel Stenberg (12 Feb 2010) -- Jack Zhang reported a problem with SMTP: we wrongly used multiple addresses - in the same RCPT TO line, when they should be sent in separate single - commands. I updated test case 802 to verify this. - -- I also fixed a bad use of my_setopt_str() of CURLOPT_MAIL_RCPT in the curl - tool which made it try to output it as string for the --libcurl feature - which could lead to crashes. - -Yang Tse (11 Feb 2010) -- Steven M. Schweda fixed VMS builder bad behavior when used in a batch job, - removed obsolete batch_compile.com and defines.com and updated VMS readme. - -Version 7.20.0 (9 February 2010) - -Daniel Stenberg (9 Feb 2010) -- When downloading compressed content over HTTP and the app asked libcurl to - automatically uncompress it with the CURLOPT_ENCODING option, libcurl could - wrongly provide the callback with more data than the maximum documented - amount. An application could thus get tricked into badness if the maximum - limit was trusted to be enforced by libcurl itself (as it is documented). - - This is further detailed and explained in the libcurl security advisory - 20100209 at - - https://curl.haxx.se/docs/adv_20100209.html - -Daniel Fandrich (3 Feb 2010) -- Changed the Watcom makefiles to make them easier to keep in sync with - Makefile.inc since that can't be included directly. - -Yang Tse (2 Feb 2010) -- Symbol CURL_FORMAT_OFF_T now obsoleted, will be removed in a future release, - symbol will not be available when building with CURL_NO_OLDIES defined. Use - of CURL_FORMAT_CURL_OFF_T is preferred since 7.19.0 - -Daniel Stenberg (1 Feb 2010) -- Using the multi_socket API, it turns out at times it seemed to "forget" - connections (which caused a hang). It turned out to be an existing (7.19.7) - bug in libcurl (that's been around for a long time) and it happened like - this: - - The app calls curl_multi_add_handle() to add a new easy handle, libcurl will - then set it to timeout in 1 millisecond so libcurl will tell the app about - it. - - The app's timeout fires off that there's a timeout, the app calls libcurl as - we so often document it: - - do { - res = curl_multi_socket_action(... TIMEOUT ...); - } while(CURLM_CALL_MULTI_PERFORM == res); - - And this is the problem number one: - - When curl_multi_socket_action() is called with no specific handle, but only - a timeout-action, it will *only* perform actions within libcurl that are - marked to run at this time. In this case, the request would go from INIT to - CONNECT and return CURLM_CALL_MULTI_PERFORM. When the app then calls libcurl - again, there's no timer set for this handle so it remains in the CONNECT - state. The CONNECT state is a transitional state in libcurl so it reports no - sockets there, and thus libcurl never tells the app anything more about that - easy handle/connection. - - libcurl _does_ set a 1ms timeout for the handle at the end of - multi_runsingle() if it returns CURLM_CALL_MULTI_PERFORM, but since the loop - is instant the new job is not ready to run at that point (and there's no - code that makes libcurl call the app to update the timout for this new - timeout). It will simply rely on that some other timeout will trigger later - on or that something else will update the timeout callback. This makes the - bug fairly hard to repeat. - - The fix made to adress this issue: - - We introduce a loop in lib/multi.c around all calls to multi_runsingle() and - simply check for CURLM_CALL_MULTI_PERFORM internally. This has the added - benefit that this goes in line with my long-term wishes to get rid of the - CURLM_CALL_MULTI_PERFORM all together from the public API. - - The downside of this fix, is that the counter we return in 'running_handles' - in several of our public functions then gets a slightly new and possibly - confusing behavior during times: - - If an app adds a handle that fails to connect (very quickly) it may just - as well never appear as a 'running_handle' with this fix. Previously it - would first bump the counter only to get it decreased again at next call. - Even I have used that change in handle counter to signal "end of a - transfer". The only *good* way to find the end of a individual transfer - is calling curl_multi_info_read() to see if it returns one. - - Of course, if the app previously did the looping before it checked the - counter, it really shouldn't be any new effect. - -Yang Tse (26 Jan 2010) -- Constantine Sapuntzakis' and Joshua Kwan's work done in the last four months - relative to the asynchronous DNS lookups, along with with some integration - adjustments I have done are finally committed to CVS. - - Currently these enhancements will benefit builds done using c-ares on any - platform as well as Windows builds using the default threaded resolver. - - This release does not make generally available POSIX threaded DNS lookups - yet. There is no configure option to enable this feature yet. It is possible - to experimantally try this feature running configure with compiler flags that - make simultaneous definition of preprocessor symbols USE_THREADS_POSIX and - HAVE_PTHREAD_H, as well as whatever reentrancy compiler flags and linker ones - are required to link and properly use pthread_* functions on each platform. - -Daniel Stenberg (26 Jan 2010) -- Mike Crowe made libcurl return CURLE_COULDNT_RESOLVE_PROXY when it is the - proxy that cannot be resolved when using c-ares. This matches the behaviour - when not using c-ares. - -Björn Stenberg (23 Jan 2010) -- Added a new flag: -J/--remote-header-name. This option tells the - -O/--remote-name option to use the server-specified Content-Disposition - filename instead of extracting a filename from the URL. - -Daniel Stenberg (21 Jan 2010) -- Chris Conroy brought support for RTSP transfers, and with it comes 8(!) new - libcurl options for controlling what to get and how to receive posssibly - interleaved RTP data. - -Daniel Stenberg (20 Jan 2010) -- As was pointed out on the http-state mailing list, the order of cookies in a - HTTP Cookie: header _needs_ to be sorted on the path length in the cases - where two cookies using the same name are set more than once using - (overlapping) paths. Realizing this, identically named cookies must be - sorted correctly. But detecting only identically named cookies and take care - of them individually is harder than just to blindly and unconditionally sort - all cookies based on their path lengths. All major browsers also already do - this, so this makes our behavior one step closer to them in the cookie area. - - Test case 8 was the only one that broke due to this change and I updated it - accordingly. - -Daniel Stenberg (19 Jan 2010) -- David McCreedy brought a fix and a new test case (129) to make libcurl work - again when downloading files over FTP using ASCII and it turns out that the - final size of the file is not the same as the initial size the server - reported. This is very common since servers don't take the newline - conversions into account. - -Kamil Dudka (14 Jan 2010) -- Suppressed side effect of OpenSSL configure checks, which prevented NSS from - being properly detected under certain circumstances. It had been caused by - strange behavior of pkg-config when handling PKG_CONFIG_LIBDIR. pkg-config - distinguishes among empty and non-existent environment variable in that case. - -Daniel Stenberg (12 Jan 2010) -- Gil Weber reported a peculiar flaw with the multi interface when doing SFTP - transfers: curl_multi_fdset() would return -1 and not set and file - descriptors several times during a transfer of a single file. It turned out - to be due to two different flaws now fixed. Gil's excellent recipe helped me - nail this. - -Daniel Stenberg (11 Jan 2010) -- Made sure that the progress callback is repeatedly called at a regular - interval even during very slow connects. - -- The tests/runtests.pl script now checks to see if the test case that runs is - present in the tests/data/Makefile.am and outputs a notice message on the - screen if not. Each test file has to be included in that Makefile.am to get - included in release archives and forgetting to add files there is a common - mistake. This is an attempt to make it harder to forget. - -Daniel Stenberg (9 Jan 2010) -- Johan van Selst found and fixed a OpenSSL session ref count leak: - - ossl_connect_step3() increments an SSL session handle reference counter on - each call. When sessions are re-used this reference counter may be - incremented many times, but it will be decremented only once when done (by - Curl_ossl_session_free()); and the internal OpenSSL data will not be freed - if this reference count remains positive. When a session is re-used the - reference counter should be corrected by explicitly calling - SSL_SESSION_free() after each consecutive SSL_get1_session() to avoid - introducing a memory leak. - - (https://curl.haxx.se/bug/view.cgi?id=2926284) - -Daniel Stenberg (7 Jan 2010) -- Make sure the progress callback is called repeatedly even during very slow - name resolves when c-ares is used for resolving. - -Claes Jakobsson (6 Jan 2010) -- Julien Chaffraix fixed so that the fragment part in an URL is not sent - to the server anymore. - -Kamil Dudka (3 Jan 2010) -- Julien Chaffraix eliminated a duplicated initialization in singlesocket(). - -Daniel Stenberg (2 Jan 2010) -- Make curl support --ssl and --ssl-reqd instead of the previous FTP-specific - versions --ftp-ssl and --ftp-ssl-reqd as these options are now used to - control SSL/TLS for IMAP, POP3 and SMTP as well in addition to FTP. The old - option names are still working but the new ones are the ones listed and - documented. - -Daniel Stenberg (1 Jan 2010) -- Ingmar Runge enhanced libcurl's FTP engine to support the PRET command. This - command is a special "hack" used by the drftpd server, but even though it is - a custom extension I've deemed it fine to add to libcurl since this server - seems to survive and people keep using it and want libcurl to support - it. The new libcurl option is named CURLOPT_FTP_USE_PRET, and it is also - usable from the curl tool with --ftp-pret. Using this option on a server - that doesn't support this command will make libcurl fail. - - I added test cases 1107 and 1108 to verify the functionality. - - The PRET command is documented at - http://www.drftpd.org/index.php/Distributed_PASV - -Yang Tse (30 Dec 2009) -- Steven M. Schweda improved VMS build system, and Craig A. Berry helped - with the patch and testing. - -Daniel Stenberg (26 Dec 2009) -- Renato Botelho and Peter Pentchev brought a patch that makes the libcurl - headers work correctly even on FreeBSD systems before v8. - - (https://curl.haxx.se/bug/view.cgi?id=2916915) - -Daniel Stenberg (17 Dec 2009) -- David Byron fixed Curl_ossl_cleanup to actually call ENGINE_cleanup when - available. - -- Follow-up fix for the proxy fix I did for Jon Nelson's bug. It turned out I - was a bit too quick and broke test case 1101 with that change. The order of - some of the setups is sensitive. I now changed it slightly again to make - sure we do them in this order: - - 1 - parse URL and figure out what protocol is used in the URL - 2 - prepend protocol:// to URL if missing - 3 - parse name+password off URL, which needs to know what protocol is used - (since only some allows for name+password in the URL) - 4 - figure out if a proxy should be used set by an option - 5 - if no proxy option, check proxy environment variables - 6 - run the protocol-specific setup function, which needs to have the proxy - already set - -Daniel Stenberg (15 Dec 2009) -- Jon Nelson found a regression that turned out to be a flaw in how libcurl - detects and uses proxies based on the environment variables. If the proxy - was given as an explicit option it worked, but due to the setup order - mistake proxies would not be used fine for a few protocols when picked up - from '[protocol]_proxy'. Obviously this broke after 7.19.4. I now also added - test case 1106 that verifies this functionality. - - (https://curl.haxx.se/bug/view.cgi?id=2913886) - -Daniel Stenberg (12 Dec 2009) -- IMAP, POP3 and SMTP support and their TLS versions (including IMAPS, POP3S - and SMTPS) are now supported. The current state may not yet be solid, but - the foundation is in place and the test suite has some initial support for - these protocols. Work will now persue to make them nice libcurl citizens - until release. - - The work with supporting these new protocols was sponsored by - networking4all.com - thanks! - -Daniel Stenberg (10 Dec 2009) -- Siegfried Gyuricsko found out that the curl manual said --retry would retry - on FTP errors in the transient 5xx range. Transient FTP errors are in the - 4xx range. The code itself only tried on 5xx errors that occured _at login_. - Now the retry code retries on all FTP transfer failures that ended with a - 4xx response. - - (https://curl.haxx.se/bug/view.cgi?id=2911279) - -- Constantine Sapuntzakis figured out a case which would lead to libcurl - accessing alredy freed memory and thus crash when using HTTPS (with - OpenSSL), multi interface and the CURLOPT_DEBUGFUNCTION and a certain order - of cleaning things up. I fixed it. - - (https://curl.haxx.se/bug/view.cgi?id=2905220) - -Daniel Stenberg (7 Dec 2009) -- Martin Storsjo made libcurl use the Expect: 100-continue header for posts - with unknown size. Previously it was only used for posts with a known size - larger than 1024 bytes. - -Daniel Stenberg (1 Dec 2009) -- If the Expect: 100-continue header has been set by the application through - curl_easy_setopt with CURLOPT_HTTPHEADER, the library should set - data->state.expect100header accordingly - the current code (in 7.19.7 at - least) doesn't handle this properly. Martin Storsjo provided the fix! - -Yang Tse (28 Nov 2009) -- Added Diffie-Hellman parameters to several test harness certificate files in - PEM format. Required by several stunnel versions used by our test harness. - -Daniel Stenberg (28 Nov 2009) -- Markus Koetter provided a polished and updated version of Chad Monroe's TFTP - rework patch that now integrates TFTP properly into libcurl so that it can - be used non-blocking with the multi interface and more. BLKSIZE also works. - - The --tftp-blksize option was added to allow setting the TFTP BLKSIZE from - the command line. - -Daniel Stenberg (26 Nov 2009) -- Extended and fixed the change I did on Dec 11 for the the progress - meter/callback during FTP command/response sequences. It turned out it was - really lame before and now the progress meter SHOULD get called at least - once per second. - -Daniel Stenberg (23 Nov 2009) -- Bjorn Augustsson reported a bug which made curl not report any problems even - though it failed to write a very small download to disk (done in a single - fwrite call). It turned out to be because fwrite() returned success, but - there was insufficient error-checking for the fclose() call which tricked - curl to believe things were fine. - -Yang Tse (23 Nov 2009) -- David Byron modified Makefile.dist vc8 and vc9 targets in order to allow - finer granularity control when generating src and lib makefiles. - -Yang Tse (22 Nov 2009) -- I modified configure to force removal of the curlbuild.h file included in - distribution tarballs for use by non-configure systems. As intended, this - would get overwriten when doing in-tree builds. But VPATH builds would end - having two curlbuild.h files, one in the source tree and another in the - build tree. With the modification I introduced 5 Nov 2009 this could become - an issue when running libcurl's test suite. - -Daniel Stenberg (20 Nov 2009) -- Constantine Sapuntzakis identified a write after close, as the sockets were - closed by libcurl before the SSL lib were shutdown and they may write to its - socket. Detected to at least happen with OpenSSL builds. - -- Jad Chamcham pointed out a bug with connection re-use. If a connection had - CURLOPT_HTTPPROXYTUNNEL enabled over a proxy, a subsequent request using the - same proxy with the tunnel option disabled would still wrongly re-use that - previous connection and the outcome would only be badness. - -Yang Tse (18 Nov 2009) -- I modified the memory tracking system to make it intolerant with zero sized - malloc(), calloc() and realloc() function calls. - -Daniel Stenberg (17 Nov 2009) -- Constantine Sapuntzakis provided another fix for the DNS cache that could - end up with entries that wouldn't time-out: - - 1. Set up a first web server that redirects (307) to a http://server:port - that's down - 2. Have curl connect to the first web server using curl multi - - After the curl_easy_cleanup call, there will be curl dns entries hanging - around with in_use != 0. - - (https://curl.haxx.se/bug/view.cgi?id=2891591) - -- Marc Kleine-Budde fixed: curl saved the LDFLAGS set during configure into - its pkg-config file. So -Wl stuff ended up in the .pc file, which is really - bad, and breaks if there are multiple -Wl in our LDFLAGS (which are in - PTXdist). bug #2893592 (https://curl.haxx.se/bug/view.cgi?id=2893592) - -Kamil Dudka (15 Nov 2009) -- David Byron improved the configure script to use pkg-config to find OpenSSL - (and in particular the list of required libraries) even if a path is given - as argument to --with-ssl - -Yang Tse (15 Nov 2009) -- I removed enable-thread / disable-thread configure option. These were only - placebo options. The library is always built as thread safe as possible on - every system. - -Claes Jakobsson (14 Nov 2009) -- curl-config now accepts '--configure' to see what arguments was - passed to the configure script when building curl. - -Daniel Stenberg (14 Nov 2009) -- Claes Jakobsson restored the configure functionality to detect NSS when - --with-nss is set but not "yes". - - I think we can still improve that to check for pkg-config in that path etc, - but at least this patch brings back the same functionality we had before. - -- Camille Moncelier added support for the file type SSL_FILETYPE_ENGINE for - the client certificate. It also disable the key name test as some engines - can select a private key/cert automatically (When there is only one key - and/or certificate on the hardware device used by the engine) - -Yang Tse (14 Nov 2009) -- Constantine Sapuntzakis provided the fix that ensures that an SSL connection - won't be reused unless protection level for peer and host verification match. - - I refactored how preprocessor symbol _THREAD_SAFE definition is done. - -Kamil Dudka (12 Nov 2009) -- Kevin Baughman provided a fix preventing libcurl-NSS from crash on doubly - closed NSPR descriptor. The issue was hard to find, reported several times - before and always closed unresolved. More info at the RH bug: - https://bugzilla.redhat.com/534176 - -- libcurl-NSS now tries to reconnect with TLS disabled in case it detects - a broken TLS server. However it does not happen if SSL version is selected - manually. The approach was originally taken from PSM. Kaspar Brand helped me - to complete the patch. Original bug reports: - https://bugzilla.redhat.com/525496 - https://bugzilla.redhat.com/527771 - -Yang Tse (12 Nov 2009) -- I modified configure script to make the getaddrinfo function check also - verify if the function is thread safe. - -Yang Tse (11 Nov 2009) -- Marco Maggi reported that compilation failed when configured --with-gssapi - and GNU GSS installed due to a missing mutual exclusion of header files in - the Kerberos 5 code path. He also verified that my patch worked for him. - -Daniel Stenberg (11 Nov 2009) -- Constantine Sapuntzakis posted bug #2891595 - (https://curl.haxx.se/bug/view.cgi?id=2891595) which identified how an entry - in the DNS cache would linger too long if the request that added it was in - use that long. He also provided the patch that now makes libcurl capable of - still doing a request while the DNS hash entry may get timed out. - -- Christian Schmitz noticed that the progress meter/callback was not properly - used during the FTP connection phase (after the actual TCP connect), while - it of course should be. I also made the speed check get called correctly so - that really slow servers will trigger that properly too. - -Kamil Dudka (5 Nov 2009) -- Dropped misleading timeouts in libcurl-NSS and made sure the SSL socket works - in non-blocking mode. - -Yang Tse (5 Nov 2009) -- I removed leading 'curl' path on the 'curlbuild.h' include statement in - curl.h, adjusting auto-makefiles include path, to enhance portability to - OS's without an orthogonal directory tree structure such as OS/400. - -Daniel Stenberg (4 Nov 2009) -- I fixed several problems with the transfer progress meter. It showed the - wrong percentage for small files, most notable for <1000 bytes and could - easily end up showing more than 100% at the end. It also didn't show any - percentage, transfer size or estimated transfer times when transferring - less than 100 bytes. - -Version 7.19.7 (4 November 2009) - -Daniel Stenberg (2 Nov 2009) -- As reported independent by both Stan van de Burgt and Didier Brisebourg, - CURLINFO_SIZE_DOWNLOAD (the -w variable size_download) didn't work when - getting data from ldap! - -Daniel Stenberg (31 Oct 2009) -- Gabriel Kuri reported a problem with CURLINFO_CONTENT_LENGTH_DOWNLOAD if the - download was 0 bytes, as libcurl would then return the size as unknown (-1) - and not 0. I wrote a fix and test case 566 to verify it. - -Daniel Stenberg (30 Oct 2009) -- Liza Alenchery mentioned a problem with re-used SCP connection when a bad - auth is used, as it caused a crash. I failed to repeat the issue, but still - made a change that now forces the TCP connection used for a freed SCP - session to get closed and not be re-used. - -- "Tom" posted a bug report that mentioned how libcurl did wrong when doing a - POST using a read callback, with Digest authentication and - "Transfer-Encoding: chunked" enforced. I would then cause the first request - to be wrongly sent and then basically hang until the server closed the - connection. I fixed the problem and added test case 565 to verify it. - -Daniel Stenberg (25 Oct 2009) -- Dima Barsky made the curl cookie parser accept cookies even with blank or - unparsable expiry dates and then treat them as session cookies - previously - libcurl would reject cookies with a date format it couldn't parse. Research - shows that the major browser treat such cookies as session cookies. I - modified test 8 and 31 to verify this. - -Daniel Stenberg (21 Oct 2009) -- Attempt to use pkg-config for finding out libssh2 installation details - during configure. - -- A patch in bug report #2883177 (https://curl.haxx.se/bug/view.cgi?id=2883177) - by Johan van Selst introduced the --crlfile option to curl, which makes curl - tell libcurl about a file with CRL (certificate revocation list) data to - read. - -Daniel Stenberg (18 Oct 2009) -- Ray Dassen provided a patch in Debian's bug tracker (bug number #551461) - that now makes curl_getdate(3) actually handles RFC 822 formatted dates that - use the "single letter military timezones". - http://www.rfc-ref.org/RFC-TEXTS/822/chapter5.html has the details. - -- Fixed memory leak in the SCP/SFTP code as it never freed the knownhosts - data! - -- John Dennis filed bug report #2873666 - (https://curl.haxx.se/bug/view.cgi?id=2873666) which identified a problem - which made libcurl loop infinitely when given incorrect credentials when - using HTTP GSS negotiate authentication. He also provided a small and simple - patch for it. - -- Kevin Baughman found a double close() problem with libcurl-NSS, as when - libcurl called NSS to close the SSL "session" it also closed the actual - socket. - -Yang Tse (17 Oct 2009) -- Bug report #2866724 indicated - (https://curl.haxx.se/bug/view.cgi?id=2866724) that curl on Windows failed - when writing files whose file names originally contained characters which - are not valid for file names on Windows. Dan Fandrich provided an initial - patch and another revised one to fix this issue. - -Daniel Stenberg (1 Oct 2009) -- Tom Mueller correctly reported in bug report #2870221 - (https://curl.haxx.se/bug/view.cgi?id=2870221) that libcurl returned an - incorrect return code from the internal trynextip() function which caused - him grief. This is a regression that was introduced in 7.19.1 and I find it - strange it hasn't hit us harder, but I won't persue into figuring out - exactly why. - -- Constantine Sapuntzakis: The current implementation will always set - SO_SNDBUF to CURL_WRITE_SIZE even if the SO_SNDBUF starts out larger. The - patch doesn't do a setsockopt if SO_SNDBUF is already greater than - CURL_WRITE_SIZE. This should help folks who have set up their computer with - large send buffers. - -Daniel Stenberg (27 Sep 2009) -- I introduced a maximum limit for received HTTP headers. It is controlled by - the define CURL_MAX_HTTP_HEADER which is even exposed in the public header - file to allow for users to fairly easy rebuild libcurl with a modified - limit. The rationale for a fixed limit is that libcurl is realloc()ing a - buffer to be able to put a full header into it, so that it can call the - header callback with the entire header, but that also risk getting it into - trouble if a server by mistake or willingly sends a header that is more or - less without an end. The limit is set to 100K. - -Daniel Stenberg (26 Sep 2009) -- John P. McCaskey posted a bug report that showed how libcurl did wrong when - saving received cookies with no given path, if the path in the request had a - query part. That is means a question mark (?) and characters on the right - side of that. I wrote test case 1105 and fixed this problem. - -Kamil Dudka (26 Sep 2009) -- Implemented a protocol independent way to specify blocking direction, used by - transfer.c for blocking. It is currently used only by SCP and SFTP protocols. - This enhancement resolves an issue with 100% CPU usage during SFTP upload, - reported by Vourhey. - -Daniel Stenberg (25 Sep 2009) -- Chris Mumford filed bug report #2861587 - (https://curl.haxx.se/bug/view.cgi?id=2861587) identifying that libcurl used - the OpenSSL function X509_load_crl_file() wrongly and failed if it would - load a CRL file with more than one certificate within. This is now fixed. - -Daniel Stenberg (16 Sep 2009) -- Sven Anders reported that we introduced a cert verfication flaw for OpenSSL- - powered libcurl in 7.19.6. If there was a X509v3 Subject Alternative Name - field in the certficate it had to match and so even if non-DNS and non-IP - entry was present it caused the verification to fail. - -Daniel Fandrich (15 Sep 2009) -- Moved the libssh2 checks after the SSL library checks. This helps when - statically linking since libssh2 needs the SSL library link flags to be - set up already to satisfy its dependencies. This wouldn't be necessary if - the libssh2 configure check was changed to use pkg-config since the - --static flag would add the dependencies automatically. - -Yang Tse (14 Sep 2009) -- Revert Joshua Kwan's patch committed 11 Sep 2009. - - Some systems poll function sets POLLHUP in revents without setting - POLLIN, and sets POLLERR without setting POLLIN and POLLOUT. In some - libcurl code execution paths this could trigger busy wait loops with - high CPU usage until a timeout condition aborted the loop. - - The reverted patch addressed the above issue for a very specific case, - when awaiting c-ares to resolve. A libcurl-wide fix for Curl_poll now - superceeds this one. - -Guenter Knauf (11 Sep 2009) -- Joshua Kwan provided a patch to pass POLLERR / POLLHUP back to c-ares. - This fixes a loop problem with high CPU usage. - -Daniel Stenberg (10 Sep 2009) -- Claes Jakobsson fixed a problem with cookie expiry dates at exctly the epoch - start second "Thu Jan 1 00:00:00 GMT 1970" as the date parser then returns 0 - which internally then is treated as a session cookie. That particular date - is now made to get the value of 1. - -Daniel Stenberg (2 Sep 2009) -- Daniel Johnson found a flaw in the code converting sftp-errors to libcurl - errors. - -Daniel Stenberg (1 Sep 2009) -- Peter Sylvester made a debug feature for Curl_resolv() that now will force - libcurl to resolve 'localhost' whatever name you use in the URL *if* you set - the --interface option to (exactly) "LocalHost". This will enable us to - write tests for custom hosts names but still use a local host server. - -- configure now tries to use pkg-config for a number of sub-dependencies even - when cross-compiling. The key to success is then you properly setup - PKG_CONFIG_PATH before invoking configure. - - I also improved how NSS is detected by trying nss-config if pkg-config isn't - present, and as a last resort just use the lib name and force the user to - setup the LIBS/LDFLAGS/CFLAGS etc properly. The previous last resort would - add a range of various libs that would almost never be quite correct. - -Daniel Stenberg (31 Aug 2009) -- When using the multi interface with FTP and you asked for NOBODY, you did no - QUOTE commands and the request used the same path as the connection had - already changed to, it would decide that no commands would be necessary for - the "DO" action and that was not handled properly but libcurl would instead - hang. - -Kamil Dudka (28 Aug 2009) -- Improved error message for not matching certificate subject name in - libcurl-NSS. Originally reported at: - https://bugzilla.redhat.com/show_bug.cgi?id=516056#c9 - -Patrick Monnerat (24 Aug 2009) -- Introduced a SYST-based test to properly set-up name format when dealing - with the OS/400 FTP server. - -- Fixed an ftp_readresp() bug preventing detection of failing control socket - and causing FTP client to loop forever. - -Daniel Stenberg (24 Aug 2009) -- Marc de Bruin pointed out that configure --with-gnutls=PATH didn't work - properly and provided a fix. https://curl.haxx.se/bug/view.cgi?id=2843008 - -- Eric Wong introduced support for the new option -T. (dot) that makes curl - read stdin in a non-blocking fashion. This also brings back -T- (minus) to - the previous blocking behavior since it could break stuff for people at - times. - -Michal Marek (21 Aug 2009) -- With CURLOPT_PROXY_TRANSFER_MODE, avoid sending invalid URLs like - ftp://example.com;type=i if the user specified ftp://example.com without the - slash. - -Daniel Stenberg (21 Aug 2009) -- Andre Guibert de Bruet pointed out a missing return code check for a - strdup() that could lead to segfault if it returned NULL. I extended his - suggest patch to now have Curl_retry_request() return a regular return code - and better check that. - -- Lots of good work by Krister Johansen, mostly related to pipelining: - - Fix SIGSEGV on free'd easy_conn when pipe unexpectedly breaks - Fix data corruption issue with re-connected transfers - Fix use after free if we're completed but easy_conn not NULL - -Kamil Dudka (13 Aug 2009) -- Changed NSS code to not ignore the value of ssl.verifyhost and produce more - verbose error messages. Originally reported at: - https://bugzilla.redhat.com/show_bug.cgi?id=516056 - -Daniel Stenberg (12 Aug 2009) -- Karl Moerder fixed the Makefile.vc* makefiles to include the new file - nonblock.c so that they work fine again - -- I expanded test 517 with a bunch of more dates that originate from the - Chrome browser test suite. It turns out most of them get parsed the same - way. - -Version 7.19.6 (12 August 2009) - -Daniel Stenberg (12 Aug 2009) -- Carsten Lange reported a bug and provided a patch for TFTP upload and the - sending of the TSIZE option. I don't like fixing bugs just hours before - a release, but since it was broken and the patch fixes this for him I decided - to get it in anyway. - -Daniel Stenberg (11 Aug 2009) -- Peter Sylvester made the HTTPS test server use specific certificates for - each test, so that the test suite can now be used to actually test the - verification of cert names etc. This made an error show up in the OpenSSL- - specific code where it would attempt to match the CN field even if a - subjectAltName exists that doesn't match. This is now fixed and verified - in test 311. - -- Benbuck Nason posted the bug report #2835196 - (https://curl.haxx.se/bug/view.cgi?id=2835196), fixing a few compiler - warnings when mixing ints and bools. - -Daniel Fandrich (10 Aug 2009) -- Fixed a memory leak in the FTP code and an off-by-one heap buffer overflow. - -Daniel Fandrich (9 Aug 2009) -- Fixed some memory leaks in the command-line tool that caused most of the - torture tests to fail. - -Daniel Stenberg (2 Aug 2009) -- Curt Bogmine reported a problem with SNI enabled on a particular server. We - should introduce an option to disable SNI, but as we're in feature freeze - now I've addressed the obvious bug here (pointed out by Peter Sylvester): we - shouldn't try to enable SNI when SSLv2 or SSLv3 is explicitly selected. - Code for OpenSSL and GnuTLS was fixed. NSS doesn't seem to have a particular - option for SNI, or are we simply not using it? - -Daniel Stenberg (1 Aug 2009) -- Scott Cantor posted the bug report #2829955 - (https://curl.haxx.se/bug/view.cgi?id=2829955) mentioning the recent SSL cert - verification flaw found and exploited by Moxie Marlinspike. The presentation - he did at Black Hat is available here: - https://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Marlinspike - - Apparently at least one CA allowed a subjectAltName or CN that contain a - zero byte, and thus clients that assumed they would never have zero bytes - were exploited to OK a certificate that didn't actually match the site. Like - if the name in the cert was "example.com\0theatualsite.com", libcurl would - happily verify that cert for example.com. - - libcurl now better uses the length of the extracted name, not using the zero - termination for getting the string length. - - This fixing only made and needed in OpenSSL interfacing code. - -- Tanguy Fautre pointed out that OpenSSL's function RAND_screen() (present - only in some OpenSSL installs - like on Windows) isn't thread-safe and we - agreed that moving it to the global_init() function is a decent way to deal - with this situation. - -- Alexander Beedie provided the patch for a noproxy problem: If I have set - CURLOPT_NOPROXY to "*", or to a host that should not use a proxy, I actually - could still end up using a proxy if a proxy environment variable was set. - -Daniel Stenberg (27 Jul 2009) -- All the quote options (CURLOPT_QUOTE, CURLOPT_POSTQUOTE and - CURLOPT_PREQUOTE) now accept a preceeding asterisk before the command to - send when using FTP, as a sign that libcurl shall simply ignore the response - from the server instead of treating it as an error. Not treating a 400+ FTP - response code as an error means that failed commands will not abort the - chain of commands, nor will they cause the connection to get disconnected. - -Daniel Stenberg (26 Jul 2009) -- Johan van Selst posted bug report #2825989 - (https://curl.haxx.se/bug/view.cgi?id=2825989) pointing out that - OpenSSL-powered libcurl didn't support the SHA-2 digest algorithm, and - provided the solution too: to use OpenSSL_add_all_algorithms() in addition - to the older SSLeay_* alternative. OpenSSL_add_all_algorithms was added in - OpenSSL 0.9.5 - -Daniel Stenberg (23 Jul 2009) -- Added CURLOPT_SSH_KNOWNHOSTS, CURLOPT_SSH_KEYFUNCTION, CURLOPT_SSH_KEYDATA. - They introduce known_host support for SSH keys to libcurl. See docs for - details. Note that this feature depends on a new enough libssh2 version, to - be supported in libssh2 1.2 and later (or current git repo at this time). - -Michal Marek (22 Jul 2009) -- David Binderman found a memory and fd leak in lib/gtls.c:load_file() - (https://bugzilla.novell.com/523919). When looking at the code, I found that - also the ptr pointer can leak. - -Kamil Dudka (20 Jul 2009) -- Claes Jakobsson improved the support for client certificates handling in - NSS-powered libcurl. Now the client certificates can be selected - automatically by a NSS built-in hook. Additionally pre-login to all PKCS11 - slots is no more performed. It used to cause problems with HW tokens. - -- Fixed reference counting for NSS client certificates. Now the PEM reader - module should be always properly unloaded on Curl_nss_cleanup(). If the - unload fails though, libcurl will try to reuse the already loaded instance. - -Daniel Fandrich (15 Jul 2009) -- Added nonblock.c to the non-automake makefiles (note that the dependencies - in the Watcom makefiles aren't quite correct). - -Michal Marek (15 Jul 2009) -- Changed the description of CURLINFO_OS_ERRNO to make it clear that the - errno is not reset on success. - -Guenter Knauf (14 Jul 2009) -- renamed generated config.h to curl_config.h to avoid any future clashes - with config.h from other projects. - -Daniel Stenberg (9 Jul 2009) -- Eric Wong introduced curlx_nonblock() that the curl tool now (re-)uses for - setting a file descriptor non-blocking. Used by the functionality Eric - himself brough on June 15th. - -Daniel Stenberg (8 Jul 2009) -- Constantine Sapuntzakis posted bug report #2813123 - (https://curl.haxx.se/bug/view.cgi?id=2813123) and an a patch that fixes the - problem: - - Url A is accessed using auth. Url A redirects to Url B (on a different - server0. Url B reuses a persistent connection. Url B has auth, even though - it's on a different server. - - Note: if Url B does not reuse a persistent connection, auth is not sent. - - reason: - - data->state.first_host is not initialized becuase Curl_http_connect is not - called when a connection is reused. - - Solution: - - move initialization of data->state.first_host to Curl_http. No code before - Curl_http uses data->state.first_host anyway. - -Guenter Knauf (4 Jul 2009) -- Markus Koetter provided a patch to avoid getnameinfo() usage which broke a - couple of both IPv4 and IPv6 autobuilds. - -Daniel Stenberg (29 Jun 2009) -- Markus Koetter made CURLOPT_FTPPORT (and curl's -P/--ftpport) support a port - range if given colon-separated after the host name/address part. Like - "192.168.0.1:2000-10000" - -- Modified the separators used for CURLOPT_CERTINFO in multi-part outputs. I - don't know how they got wrong in the first place, but using this output - format makes it possible to quite easily separate the string into an array - of multiple items. - -Daniel Fandrich (16 June 2009) -- Added a few more compiler warning options for gcc. - -Daniel Stenberg (16 Jun 2009) -- Reuven Wachtfogel made curl -o - properly produce a binary output on windows - (no newline translations). Use -B/--use-ascii if you rather get the ascii - approach. - -Michal Marek (16 Jun 2009) -- When doing non-anonymous ftp via http proxies and the password is not - provided in the url, add it there (squid needs this). - -Daniel Stenberg (15 Jun 2009) -- Eric Wong's patch: - - This allows curl(1) to be used as a client-side tunnel for arbitrary stream - protocols by abusing chunked transfer encoding in both the HTTP request and - HTTP response. This requires server support for sending a response while a - request is still being read, of course. - - If attempting to read from stdin returns EAGAIN, then we pause our sender. - This leaves curl to attempt to read from the socket while reading from stdin - (and thus sending) is paused. - - This change was needed to allow successfully tunneling the git protocol over - HTTP (--no-buffer is needed, as well). - -Patrick Monnerat (15 Jun 2009) -- Replaced use of standard C library rand()/srand() by our own pseudo-random - number generator. - -Yang Tse (11 Jun 2009) -- I adapted testcurl script to allow building test harness programs when - cross-compiling for a *-*-mingw* host. - -Daniel Stenberg (10 Jun 2009) -- Fabian Keil ran clang on the (lib)curl code, found a bunch of warnings and - contributed a range of patches to fix them. - -Yang Tse (10 Jun 2009) -- I introduced configure script option --enable-curldebug which now allows - the decoupled enabling or disabling of the curl debug memory tracking - feature from the --enable-debug option which no longer controls this. - - curl --version will list 'Debug' feature for debug enabled builds, and - will list 'TrackMemory' feature for curl debug memory tracking capable - builds. These features are independent and can be controlled when running - the configure script. When --enable-debug is given both features will be - enabled, unless some restriction prevents memory tracking from being used. - - Internally, definition of preprocessor symbol DEBUGBUILD restricts code - which is only compiled for debug enabled builds. And symbol CURLDEBUG is - used to differentiate code which is _only_ used for memory tracking. - -Yang Tse (9 Jun 2009) -- Daniel Steinberg pointed out that Curl_FormInit() in formdata.c was not - initializing the fread callback pointer and this triggered a compiler - warning, also provided a friendly suggestion on how to fix it. - -Daniel Stenberg (8 Jun 2009) -- Claes Jakobsson provided a patch for libcurl-NSS that fixed a bad refcount - issue with client certs that caused issues like segfaults. - https://curl.haxx.se/mail/lib-2009-05/0316.html - -- Triggered by bug report #2798852 and the patch in there, I fixed configure - to detect gnutls build options with pkg-config only and not libgnutls-config - anymore since GnuTLS has stopped distributing that tool. If an explicit path - is given to configure, we will instead guess on how to link and use that - lib. I did not use the patch from the bug report. - -Yang Tse (8 Jun 2009) -- Igor Novoseltsev adjusted Makefile.vxworks to get sources and headers - included from Makefile.inc, and provided docs\INSTALL VxWorks section. - -- I removed buildconf.bat from release and daily snapshot archives. This - file is only for CVS tree checkout builds. - -Daniel Stenberg (8 Jun 2009) -- Eric Wong fixed --no-buffer to actually switch off output buffering. Been - broken since 7.19.0 - -Bill Hoffman (6 Jun 2009) -- Added some cmake docs and fixed socklen_t in the build. - -Yang Tse (5 Jun 2009) -- John E. Malmberg provided VMS specific patch: "This fixes an existing bug - in urlglob.c where it was not converting the Curl Unix exit code to a VMS - DCL compatible exit code. This fix required the enhancement described next. - This also adds an enhancement to main.c so that when curl is run under a - Unix shell like Bash on VMS, it will return the standard Unix exit codes - and messages." And another patch for docs/examples. - - I introduced os-specific.c and os-specific.h for use in curl tool code - and adjusted John E. Malmberg's patch placement to use these new files - as an effort to prevent main.c from growing ad infinitum. Code already - existing in main.c which is OS specific should be moved into these files. - -Daniel Stenberg (4 June 2009) -- Setting the Content-Length: header from your app when you do a POST or PUT - is almost always a VERY BAD IDEA. Yet there are still apps out there doing - this, and now recently it triggered a bug/side-effect in libcurl as when - libcurl sends a POST or PUT with NTLM, it sends an empty post first when it - knows it will just get a 401/407 back. If the app then replaced the - Content-Length header, it caused the server to wait for input that libcurl - wouldn't send. Aaron Oneal reported this problem in bug report #2799008 - (https://curl.haxx.se/bug/view.cgi?id=2799008) and helped us verify the fix. - -Yang Tse (4 Jun 2009) -- Igor Novoseltsev provided patches and information, that after some - adjustments to better fit curl's way of doing things, have resulted - in the posibility of building libcurl for VxWorks. - -Daniel Fandrich (2 June 2009) -- Checked in a Google Android make file. To use it, you must first - create a config.h file by running configure in the Android environment, - which doesn't seem to be easy to do. If no easy way can be found, a - static config-android.h may need to be created and checked in to the - libcurl source tree. - -Daniel Stenberg (1 June 2009) -- Claes Jakobsson fixed the configure script to better find and use NSS - without pkg-config. - -Yang Tse (1 Jun 2009) -- John E. Malmberg provided a VMS specific clean-up for curl.h, and pointed - out that the configure script was failing to detect the timeval struct on - VMS when building with _XOPEN_SOURCE_EXTENDED undefined due to definition - taking place in socket.h instead of time.h. I have adjusted configure - script to also include this header when checking struct timeval. - -Daniel Stenberg (27 May 2009) -- Frank McGeough provided a small OpenSSL #include fix to make libcurl compile - fine with Nokia 5th edition 1.0 SDK for Symbian. - -- Andre Guibert de Bruet found a call to a OpenSSL function that didn't check - for a failure properly. - -- Mike Crowe pointed out that setting CURLOPT_USERPWD to NULL used to clear - the auth credentials back in 7.19.0 and earlier while now you have to set "" - to get the same effect. His patch brings back the ability to use NULL. - -- Claes Jakobsson fixed libcurl-NSS to build fine even without the - PK11_CreateGenericObject() function. - -Daniel Stenberg (25 May 2009) -- bug report #2796358 (https://curl.haxx.se/bug/view.cgi?id=2796358) pointed - out that the cookie parser would leak memory when it parses cookies that are - received with domain, path etc set multiple times in the same header. While - such a cookie is questionable, they occur in the wild and libcurl no longer - leaks memory for them. I added such a header to test case 8. - -Daniel Fandrich (22 May 2009) -- Removed some obsolete digest code that caused a valgrind error in test 551. - -Daniel Fandrich (20 May 2009) -- Added "non-existing host" test keywords to make it easy to skip those - tests on machines that have broken DNS configurations (such as - those configured to use OpenDNS). - -Daniel Stenberg (19 May 2009) -- Kamil Dudka brought the patch from the Redhat bug entry - https://bugzilla.redhat.com/show_bug.cgi?id=427966 which was libcurl closing - a bad file descriptor when closing down the FTP data connection. Caolan - McNamara seems to be the original author of it. - -Version 7.19.5 (18 May 2009) - -Daniel Stenberg (17 May 2009) -- James Bursa posted a patch to the mailing list that fixed a problem with - no_proxy which made it not skip the proxy if the URL entered contained a - user name. I added test case 1101 to verify. - -Daniel Stenberg (11 May 2009) -- Balint Szilakszi reported a memory leak when libcurl did gzip decompression - of streams that had some parts (legitimately) missing. We now provide and use - a proper cleanup function for the content encoding submodule. - https://curl.haxx.se/mail/lib-2009-05/0092.html - -- Kamil Dudka provided a fix for libcurl-NSS reported by Michael Cronenworth - at https://bugzilla.redhat.com/show_bug.cgi?id=453612#c12 - - If an incorrect password is given while loading a private key, libcurl ends - up in an infinite loop consuming memory. The bug is critical. - -- I fixed the problem with doing NTLM, POST and then following a 302 redirect, - as reported by Ebenezer Ikonne (on curl-users) and Laurent Rabret (on - curl-library). The transfer was mistakenly marked to get more data to send - but since it didn't actually have that, it just hung there... - -Daniel Stenberg (10 May 2009) -- Andre Guibert de Bruet correctly pointed out an over-alloc with one wasted - byte in the digest code. - -Yang Tse (9 May 2009) -- Removed DOS and TPF package's subdirectory Makefile.am, it was only used - to include some files in the distribution tarball serving no other purpose. - Files from the DOS and TPF subdirectories are now included in the EXTRA_DIST - of the Makefile in the parent subdirectory. - -Yang Tse (8 May 2009) -- Changed host name literal in several tests to one under the haxx.se domain. - -- Renamed vc6 workspace and project files to avoid filename clash when used - for conversion to later VS versions. - -Daniel Stenberg (8 May 2009) -- Constantine Sapuntzakis fixed bug report #2784055 - (https://curl.haxx.se/bug/view.cgi?id=2784055) identifying a problem to - connect to SOCKS proxies when using the multi interface. It turned out to - almost not work at all previously. We need to wait for the TCP connect to - be properly verified before doing the SOCKS magic. - - There's still a flaw in the FTP code for this. - -Daniel Stenberg (7 May 2009) -- Made the SO_SNDBUF setting for the data connection socket for ftp uploads as - well. See change 28 Apr 2009. - -Yang Tse (7 May 2009) -- Fixed an issue affecting FTP transfers, introduced with the transfer.c - patch committed May 4. - -Daniel Stenberg (7 May 2009) -- Man page *roff problems fixed thanks to input from Colin Watson. Problems - reported in the Debian package. - -- Vijay G filed bug report #2723236 - (https://curl.haxx.se/bug/view.cgi?id=2723236) identifying a problem with - libcurl's TFTP code and its lack of dealing with the OACK packet. - -Yang Tse (5 May 2009) -- Fixed the --ftp-port address of test #251 to the CLIENTIP address, and - reverted the change affecting test suite harness committed 4 May. - -Daniel Stenberg (5 May 2009) -- Inspired by Michael Smith's session id fix for OpenSSL, I did the - corresponding fix in the GnuTLS code: make sure to store the new session id - in case the previous re-used one is rejected. - -Daniel Stenberg (4 May 2009) -- Michael Smith posted bug report #2786255 - (https://curl.haxx.se/bug/view.cgi?id=2786255) with a patch, identifying how - libcurl did not deal with SSL session ids properly if the server rejected a - re-use of one. Starting now, it will forget the rejected one and remember - the new. This change was for OpenSSL only, it is likely that other SSL lib - code needs similar fixes. - -Yang Tse (4 May 2009) -- Applied David McCreedy's "transfer.c fixes for CURL_DO_LINEEND_CONV and - non-ASCII platform HTTP requests" patch addressing two HTTP PUT problems: - 1) On non-ASCII platforms not all of the protocol portions of the PUT are - being translated to ASCII. 2) On all platforms the line endings of part of - the protocol portions are mangled from CRLF to CRCRLF if data->set.crlf or - data->set.prefer_ascii are set (depending on CURL_DO_LINEEND_CONV). - -- Applied David McCreedy's patch to fix test suite harness to allow test FTP - server and client on different machines, providing FTP client address when - running the FTP test server. - -Daniel Fandrich (3 May 2009) -- Added and disabled test case 563 which shows KNOWN_BUGS #59. The bug - report failed to mention that a proxy must be used to reproduce it. - -Yang Tse (2 May 2009) -- Use a build-time configured curl_socklen_t data type instead of socklen_t. - -Yang Tse (1 May 2009) -- Applied David McCreedy's patches "TPF-platform specific changes to various - files" and "http.c fix to Curl_proxyCONNECT for non-ASCII platforms", the - former with minor edits. - -Daniel Stenberg (30 Apr 2009) -- I was going to fix issue #59 in KNOWN_BUGS - - If the CURLOPT_PORT option is used on an FTP URL like - "ftp://example.com/file;type=A" the ";type=A" is stripped off. - - I added test case 562 to verify, only to find out that I couldn't repeat - this bug so I hereby consider it not a bug anymore! - -Daniel Stenberg (29 Apr 2009) -- Based on bug report #2723219 (https://curl.haxx.se/bug/view.cgi?id=2723219) - I've now made TFTP "connections" not being kept for re-use within libcurl. - TFTP is UDP-based so the benefit was really low (if even existing) to begin - with so instead of tracking down to fix this problem we instead removed the - re-use. I also enabled test case 1099 that I wrote a few days ago to verify - that this change fixes the reported problem. - -Daniel Stenberg (28 Apr 2009) -- Constantine Sapuntzakis filed bug report #2783090 - (https://curl.haxx.se/bug/view.cgi?id=2783090) pointing out that on windows - we need to grow the SO_SNDBUF buffer somewhat to get really good upload - speeds. https://support.microsoft.com/kb/823764 has the details. Friends - confirmed that simply adding 32 to CURL_MAX_WRITE_SIZE is enough. - -- Bug report #2709004 (https://curl.haxx.se/bug/view.cgi?id=2709004) by Tim - Chen pointed out how curl couldn't upload with resume when reading from a - pipe. - - This ended up with the introduction of a new return code for the - CURLOPT_SEEKFUNCTION callback that basically says that the seek failed but - that libcurl may try to resolve the situation anyway. In our case this means - libcurl will attempt to instead read that much data from the stream instead - of seeking and that way curl can now upload with resume when data is read - from a stream! - -Daniel Stenberg (26 Apr 2009) -- Bug report #2779733 (https://curl.haxx.se/bug/view.cgi?id=2779733) by Sven - Wegener pointed out that CURLINFO_APPCONNECT_TIME didn't work with the multi - interface and provided a patch that fixed the problem! - -Daniel Stenberg (24 Apr 2009) -- Kamil Dudka fixed another NSS-related leak when client certs were used. - -- Bug report #2779245 (https://curl.haxx.se/bug/view.cgi?id=2779245) by Rainer - Koenig pointed out that the man page didn't tell that the *_proxy - environment variables can be specified lower case or UPPER CASE and the - lower case takes precedence, - -Daniel Fandrich (21 Apr 2009) -- Added new libcurl source files to Amiga, RiscOS and VC6 build files. - -Yang Tse (21 Apr 2009) -- Moved potential inclusion of system's malloc.h and memory.h header files to - setup_once.h. Inclusion of each header file is based on the definition of - NEED_MALLOC_H and NEED_MEMORY_H respectively. - - Renamed libcurl's memory.h to curl_memory.h - -Daniel Stenberg (20 Apr 2009) -- Leanic Lefever reported a crash and did some detailed research on why and - how it occurs (https://curl.haxx.se/mail/lib-2009-04/0289.html). The - conclusion was that if an error is detected and Curl_done() is called for - the connection, ftp_done() could at times return another error code that - then would take precedence and that new code confused existing logic that - works for the first error code (CURLE_SEND_ERROR) only. - -- Gisle Vanem noticed that --libtool would produce bogus strings at times for - OBJECTPOINT options. Now we've introduced a new function - my_setopt_str - - within the app for setting plain string options to avoid the risk of this - mistake happening. - -Daniel Stenberg (17 Apr 2009) -- Pramod Sharma reported and tracked down a bug when doing FTP over a HTTP - proxy. libcurl would then wrongly close the connection after each - request. In his case it had the weird side-effect that it killed NTLM auth - for the proxy causing an inifinite loop! - - I added test case 1098 to verify this fix. The test case does however not - properly verify that the transfers are done persistently - as I couldn't - think of a clever way to achieve it right now - but you need to read the - stderr output after a test run to see that it truly did the right thing. - -Daniel Stenberg (13 Apr 2009) -- bug report #2727981 (https://curl.haxx.se/bug/view.cgi?id=2727981) by Martin - Storsjö pointed out how setting CURLOPT_NOBODY to 0 could be downright - confusing as it set the method to either GET or HEAD. The example he showed - looked like: - - curl_easy_setopt(curl, CURLOPT_PUT, 1); - curl_easy_setopt(curl, CURLOPT_NOBODY, 0); - - The new way doesn't alter the method until the request is about to start. If - CURLOPT_NOBODY is then 1 the HTTP request will be HEAD. If CURLOPT_NOBODY is - 0 and the request happens to have been set to HEAD, it will then instead be - set to GET. I believe this will be less surprising to users, and hopefully - not hit any existing users badly. - -- Toshio Kuratomi reported a memory leak problem with libcurl+NSS that turned - out to be leaking cacerts. Kamil Dudka helped me complete the fix. The issue - is found in Redhat's bug tracker: - https://bugzilla.redhat.com/show_bug.cgi?id=453612 - - There are still memory leaks present, but they seem to have other reasons. - -Daniel Fandrich (11 Apr 2009) -- Added new libcurl source files to Symbian OS build files. -- Improved Symbian support for SSL. - -Yang Tse (10 Apr 2009) -- Daniel Johnson improved the MacOSX-Framework shell script to now perform all - the steps required to build a Mac OS X four way fat ppc/i386/ppc64/x86_64 - libcurl.framework. Four way fat framework requires OS X 10.5 SDK or later. - -Yang Tse (8 Apr 2009) -- Removed Sun compilers preprocessor block from curlbuild.h.dist, this also - removes it from the curlbuild.h file originally distributed by the cURL - project as this file is intended for systems not capable of running the - configure script. For those who have been building curl out of the source - code curl distribution tarball provided by curl.haxx.se the change implies - nothing. Previous change in this area committed 2 Apr becomes irrelevant. - -Daniel Stenberg (6 Apr 2009) -- I clarified in the docs that CURLOPT_SEEKFUNCTION should return 0 on success - and 1 on fatal errors. Previously it only mentioned non-zero on fatal - errors. This is a slight change in meaning, but it follows what we've done - elsewhere before and it opens up for LOTS of more useful return codes - whenever we can think of them... - -Yang Tse (2 Apr 2009) -- Fix curl_off_t definition for builds done using Sun compilers and a - non-configured libcurl. In this case curl_off_t data type was gated - to the off_t data type which depends on the _FILE_OFFSET_BITS. This - configuration is exactly the unwanted configuration for our curl_off_t - data type which must not depend on such setting. This breaks ABI for - libcurl libraries built with Sun compilers which were built without - having run the configure script with _FILE_OFFSET_BITS different than - 64 and using the ILP32 data model. - -Daniel Stenberg (1 Apr 2009) -- Andre Guibert de Bruet fixed a NULL pointer use in an infof() call if a - strdup() call failed. - -Daniel Fandrich (31 Mar 2009) -- Properly return an error code in curl_easy_recv (reported by Jim Freeman). - -Daniel Stenberg (18 Mar 2009) -- Kamil Dudka brought a patch that enables 6 additional crypto algorithms when - NSS is used. These ciphers were added in NSS 3.4 and require to be enabled - explicitly. - -Daniel Stenberg (13 Mar 2009) -- Use libssh2_version() to present the libssh2 version in case the libssh2 - library is found to support it. - -Yang Tse (12 Mar 2009) -- Added missing Curl_read() return code checking in TELNET transfers. - -- Pierre Brico found and fixed TELNET transfers not being aborted upon - a write callback failure. - -Daniel Stenberg (11 Mar 2009) -- Kamil Dudka made the curl tool properly call curl_global_init() before any - other libcurl function. - -Yang Tse (11 Mar 2009) -- Added missing TELNET timeout support for Windows builds. This issue was - reported by Pierre Brico. - -Daniel Stenberg (9 Mar 2009) -- Frank Hempel found out a bug and provided the fix: - - curl_easy_duphandle did not necessarily duplicate the CURLOPT_COOKIEFILE - option. It only enabled the cookie engine in the destination handle if - data->cookies is not NULL (where data is the source handle). In case of a - newly initialized handle which just had the cookie support enabled by a - curl_easy_setopt(handle, CURL_COOKIEFILE, "")-call, handle->cookies was - still NULL because the setopt-call only appends the value to - data->change.cookielist, hence duplicating this handle would not have the - cookie engine switched on. - - We also concluded that the slist-functionality would be suitable for being - put in its own module rather than simply hanging out in lib/sendf.c so I - created lib/slist.[ch] for them. - -- Andreas Farber made the 'buildconf' script check for the presence of m4 - scripts to make it detect a bad checkout earlier. People with older - checkouts who don't do cvs update with the -d option won't get the new dirs - and then will get funny outputs that can be a bit hard to understand and - fix. - -Daniel Stenberg (8 Mar 2009) -- Andre Guibert de Bruet found and fixed a code segment in ssluse.c where the - allocation of the memory BIO was not being properly checked. - -- Andre Guibert de Bruet fixed the gnutls-using code: There are a few places - in the gnutls code where we were checking for negative values for errors, - when the man pages state that GNUTLS_E_SUCCESS is returned on success and - other values indicate error conditions. - -- Bill Egert pointed out (https://curl.haxx.se/bug/view.cgi?id=2671602) that - curl didn't use sprintf() in a way that is documented to work in POSIX but - since we use our own printf() code (from libcurl) that shouldn't be a - problem. Nonetheless I modified the code to not rely on such particular - features and to not cause further raised eyebrowse with no good reason. - -Daniel Fandrich (5 Mar 2009) -- Expanded the security section of the libcurl-tutorial man page to cover - more issues for authors to consider when writing robust libcurl-using - applications. - -Yang Tse (5 Mar 2009) -- Fixed NTLM authentication memory leak on SSPI enabled Windows builds. This - issue was noticed by Chris Deidun. - -Daniel Fandrich (4 Mar 2009) -- Fixed a problem with m4 quoting in the OpenSSL configure check reported - by Daniel Johnson. - -Daniel Stenberg (3 Mar 2009) -- David James brought a patch that make libcurl close (all) dead connections - whenever you attempt to open a new connection. - - 1. After cleaning up a dead connection, "continue" instead of - returning FALSE. This ensures that we clean up all dead connections, - rather than just cleaning up the first dead connection. - 2. Move up the cleanup for dead connections so that it occurs for - all connections, rather than just the connections which have the same - preferences as our current new connection. - -Version 7.19.4 (3 March 2009) - -Daniel Stenberg (3 Mar 2009) -- David Kierznowski notified us about a security flaw - (https://curl.haxx.se/docs/adv_20090303.html also known as CVE-2009-0037) in - which previous libcurl versions (by design) can be tricked to access an - arbitrary local/different file instead of a remote one when - CURLOPT_FOLLOWLOCATION is enabled. This flaw is now fixed in this release - together this the addition of two new setopt options for controlling this - new behavior: - - o CURLOPT_REDIR_PROTOCOLS controls what protocols libcurl is allowed to - follow to when CURLOPT_FOLLOWLOCATION is enabled. By default, this option - excludes the FILE and SCP protocols and thus you nee to explicitly allow - them in your app if you really want that behavior. - - o CURLOPT_PROTOCOLS controls what protocol(s) libcurl is allowed to fetch - using the primary URL option. This is useful if you want to allow a user or - other outsiders control what URL to pass to libcurl and yet not allow all - protocols libcurl may have been built to support. - -Daniel Stenberg (27 Feb 2009) -- Senthil Raja Velu reported a problem when CURLOPT_INTERFACE and - CURLOPT_LOCALPORT were used together (the local port bind failed), and - Markus Koetter provided the fix! - -Daniel Stenberg (25 Feb 2009) -- As Daniel Fandrich figured out, we must do the GnuTLS initing in the - curl_global_init() function to properly maintain the performing functions - thread-safe. We've previously (28 April 2007) moved the init to a later time - just to avoid it to fail very early when libgcrypt dislikes the situation, - but that move was bad and the fix should rather be in libgcrypt or - elsewhere. - -Daniel Stenberg (24 Feb 2009) -- Brian J. Murrell found out that Negotiate proxy authentication didn't work. - It happened because the code used the struct for server-based auth all the - time for both proxy and server auth which of course was wrong. - -Daniel Stenberg (23 Feb 2009) -- After a bug reported by James Cheng I've made curl_easy_getinfo() for - CURLINFO_CONTENT_LENGTH_DOWNLOAD and CURLINFO_CONTENT_LENGTH_UPLOAD return - -1 if the sizes aren't know. Previously these returned 0, make it impossible - to detect the difference between actually zero and unknown. - -Yang Tse (23 Feb 2009) -- Daniel Johnson provided a shell script that will perform all the steps needed - to build a Mac OS X fat ppc/i386 or ppc64/x86_64 libcurl.framework - -Daniel Stenberg (23 Feb 2009) -- I renamed everything in the windows builds files that used the name 'curllib' - to the proper 'libcurl' as clearly this caused confusion. - -Yang Tse (20 Feb 2009) -- Do not halt compilation when using VS2008 to build a Windows 2000 target. - -Daniel Stenberg (20 Feb 2009) -- Linus Nielsen Feltzing reported and helped me repeat and fix a problem with - FTP with the multi interface: when a transfer fails, like when aborted by a - write callback, the control connection was wrongly closed and thus not - re-used properly. - - This change is also an attempt to cleanup the code somewhat in this area, as - now the FTP code attempts to keep (better) track on pending responses - necessary to get read in ftp_done(). - -Daniel Stenberg (19 Feb 2009) -- Patrik Thunstrom reported a problem and helped me repeat it. It turned out - libcurl did a superfluous 1000ms wait when doing SFTP downloads! - - We read data with libssh2 while doing the "DO" operation for SFTP and then - when we were about to start getting data for the actual file part, the - "TRANSFER" part, we waited for socket action (in 1000ms) before doing a - libssh2-read. But in this case libssh2 had already read and buffered the - data so we ended up always just waiting 1000ms before we get working on the - data! - -Patrick Monnerat (18 Feb 2009) -- FTP downloads (i.e.: RETR) ending with code 550 now return error - CURLE_REMOTE_FILE_NOT_FOUND instead of CURLE_FTP_COULDNT_RETR_FILE. - -Daniel Stenberg (17 Feb 2009) -- Kamil Dudka made NSS-powered builds compile and run again! - -- A second follow-up change by Andre Guibert de Bruet to fix a related memory - leak like that fixed on the 14th. When zlib returns failure, we need to - cleanup properly before returning error. - -- CURLOPT_FTP_CREATE_MISSING_DIRS can now be set to 2 in addition to 1 for - plain FTP connections, and it will then allow MKD to fail once and retry the - CWD afterwards. This is especially useful if you're doing many simultanoes - connections against the same server and they all have this option enabled, - as then CWD may first fail but then another connection does MKD before this - connection and thus MKD fails but trying CWD works! The numbers can - (should?) now be set with the convenience enums now called - CURLFTP_CREATE_DIR and CURLFTP_CREATE_DIR_RETRY. - - Tests has proven that if you're making an application that uploads a set of - files to an ftp server, you will get a noticable gain in speed if you're - using multiple connections and this option will be then be very useful. - -Daniel Stenberg (14 Feb 2009) -- Andre Guibert de Bruet found and fixed a memory leak in the content encoding - code, which could happen on libz errors. - -Daniel Fandrich (12 Feb 2009) -- Added support for Digest and NTLM authentication using GnuTLS. - -Daniel Stenberg (11 Feb 2009) -- CURLINFO_CONDITION_UNMET was added to allow an application to get to know if - the condition in the previous request was unmet. This is typically a time - condition set with CURLOPT_TIMECONDITION and was previously not possible to - reliably figure out. From bug report #2565128 - (https://curl.haxx.se/bug/view.cgi?id=2565128) filed by Jocelyn Jaubert. - -Daniel Fandrich (4 Feb 2009) -- Don't add the standard /usr/lib or /usr/include paths to LDFLAGS and CPPFLAGS - (respectively) when --with-ssl=/usr is used (patch based on FreeBSD). - -- Added an explicit buffer limit check in msdosify() (patch based on FreeBSD). - This couldn't ever overflow in curl, but might if the code were used - elsewhere or under different conditions. - -Daniel Stenberg (3 Feb 2009) -- Hidemoto Nakada provided a small fix that makes it possible to get the - CURLINFO_CONTENT_LENGTH_DOWNLOAD size from file:// "transfers" with - CURLOPT_NOBODY set true. - -Daniel Stenberg (2 Feb 2009) -- Patrick Scott found a rather large memory leak when using the multi - interface and setting CURLMOPT_MAXCONNECTS to something less than the number - of handles you add to the multi handle. All the connections that didn't fit - in the cache would not be properly disconnected nor freed! - -- Craig A West brought us: libcurl now defaults to do CONNECT with HTTP - version 1.1 instead of 1.0 like before. This change also introduces the new - proxy type for libcurl called 'CURLPROXY_HTTP_1_0' that then allows apps to - switch (back) to CONNECT 1.0 requests. The curl tool also got a --proxy1.0 - option that works exactly like --proxy but sets CURLPROXY_HTTP_1_0. - - I updated all test cases cases that use CONNECT and I tried to do some using - --proxy1.0 and some updated to do CONNECT 1.1 to get both versions run. - -Daniel Stenberg (31 Jan 2009) -- When building with c-ares 1.6.1 (not yet released) or later and IPv6 support - enabled, we can now take advantage of its brand new AF_UNSPEC support in - ares_gethostbyname(). This makes test case 241 finally run fine for me with - this setup since it now parses the "::1 ip6-localhost" line fine in my - /etc/hosts file! - -Daniel Stenberg (30 Jan 2009) -- Scott Cantor filed bug report #2550061 - (https://curl.haxx.se/bug/view.cgi?id=2550061) mentioning that I failed to - properly make sure that the VC9 makefiles got included in the latest - release. I've now fixed the release script and verified it so next release - will hopefully include them properly! - -Daniel Fandrich (30 Jan 2009) -- Fixed --disable-proxy for FTP and SOCKS. Thanks to Daniel Egger for - reporting. - -Yang Tse (29 Jan 2009) -- Introduced curl_sspi.c and curl_sspi.h for the implementation of functions - Curl_sspi_global_init() and Curl_sspi_global_cleanup() which previously were - named Curl_ntlm_global_init() and Curl_ntlm_global_cleanup() in http_ntlm.c - Also adjusted socks_sspi.c to remove the link-time dependency on the Windows - SSPI library using it now in the same way as it was done in http_ntlm.c. - -Daniel Stenberg (28 Jan 2009) -- Markus Moeller introduced two new options to libcurl: - CURLOPT_SOCKS5_GSSAPI_SERVICE and CURLOPT_SOCKS5_GSSAPI_NEC to allow libcurl - to do GSS-style authentication with SOCKS5 proxies. The curl tool got the - options called --socks5-gssapi-service and --socks5-gssapi-nec to enable - these. - -Daniel Stenberg (26 Jan 2009) -- Chad Monroe provided the new CURLOPT_TFTP_BLKSIZE option that allows an app - to set desired block size to use for TFTP transfers instead of the default - 512 bytes. - -- The "-no_ticket" option was introduced in Openssl0.9.8j. It's a flag to - disable "rfc4507bis session ticket support". rfc4507bis was later turned - into the proper RFC5077 it seems: http://tools.ietf.org/html/rfc5077 - - The enabled extension concerns the session management. I wonder how often - libcurl stops a connection and then resumes a TLS session. also, sending the - session data is some overhead. .I suggest that you just use your proposed - patch (which explicitly disables TICKET). - - If someone writes an application with libcurl and openssl who wants to - enable the feature, one can do this in the SSL callback. - - Sharad Gupta brought this to my attention. Peter Sylvester helped me decide - on the proper action. - -- Alexey Borzov filed bug report #2535504 - (https://curl.haxx.se/bug/view.cgi?id=2535504) pointing out that realms with - quoted quotation marks in HTTP Digest headers didn't work. I've now added - test case 1095 that verifies my fix. - -- Craig A West brought CURLOPT_NOPROXY and the corresponding --noproxy option. - They basically offer the same thing the NO_PROXY environment variable only - offered previously: list a set of host names that shall not use the proxy - even if one is specified. - -Daniel Fandrich (20 Jan 2009) -- Call setlocale() for libtest tests to test the effects of locale-induced - libc changes on libcurl. - -- Fixed a couple more locale-dependent toupper conversions, mainly for - clarity. This does fix one problem that causes ;type=i FTP URLs - to fail in the Turkish locale when CURLOPT_PROXY_TRANSFER_MODE is - used (test case 561) - -- Added tests 561 and 1091 through 1094 to test various combinations - of ;type= and ;mode= URLs that could potentially fail in the Turkish - locale. - -Daniel Stenberg (20 Jan 2009) -- Lisa Xu pointed out that the ssh.obj file was missing from the - lib/Makefile.vc6 file (and thus from the vc8 and vc9 ones too). - -Version 7.19.3 (19 January 2009) - -Daniel Stenberg (16 Jan 2009) -- Andrew de los Reyes fixed curlbuild.h for "generic" gcc builds on PPC, both - 32 bit and 64 bit. - -Daniel Stenberg (15 Jan 2009) -- Tim Ansell fixed a compiler warning in lib/cookie.c - -Daniel Stenberg (14 Jan 2009) -- Grant Erickson fixed timeouts for TFTP such that specifying a - connect-timeout, a max-time or both options work correctly and as expected - by passing the correct boolean value to Curl_timeleft via the - 'duringconnect' parameter. - - With this small change, curl TFTP now behaves as expected (and likely as - originally-designed): - - 1) For non-existent or unreachable dotted IP addresses: - - a) With no options, follows the default curl 300s timeout... - b) With --connect-timeout only, follows that value... - c) With --max-time only, follows that value... - d) With both --connect-timeout and --max-time, follows the smaller value... - - and times out with a "curl: (7) Couldn't connect to server" error. - - 2) For transfers to/from a valid host: - - a) With no options, follows default curl 300s timeout for the - first XRQ/DATA/ACK transaction and the default TFTP 3600s - timeout for the remainder of the transfer... - - b) With --connect-time only, follows that value for the - first XRQ/DATA/ACK transaction and the default TFTP 3600s - timeout for the remainder of the transfer... - - c) With --max-time only, follows that value for the first - XRQ/DATA/ACK transaction and for the remainder of the - transfer... - - d) With both --connect-timeout and --max-time, follows the former - for the first XRQ/DATA/ACK transaction and the latter for the - remainder of the transfer... - - and times out with a "curl: (28) Timeout was reached" error as - appropriate. - -Daniel Stenberg (13 Jan 2009) -- Michael Wallner fixed a NULL pointer deref when calling - curl_easy_setup(curl, CURLOPT_COOKIELIST, "SESS") on a CURL handle with no - cookies data. - -- Stefan Teleman brought a patch to fix the default curlbuild.h file for the - SunPro compilers. - -Daniel Stenberg (12 Jan 2009) -- Based on bug report #2498665 (https://curl.haxx.se/bug/view.cgi?id=2498665) - by Daniel Black, I've now added magic to the configure script that makes it - use pkg-config to detect gnutls details as well if the existing method - (using libgnutls-config) fails. While doing this, I cleaned up and unified - the pkg-config usage when detecting openssl and nss as well. - -Daniel Stenberg (11 Jan 2009) -- Karl Moerder brought the patch that creates vc9 Makefiles, and I made - 'maketgz' now use the actual makefile targets to do the VC8 and VC9 - makefiles. - -Daniel Stenberg (10 Jan 2009) -- Emil Romanus fixed: - - When using the multi interface over HTTP and the server returns a Location - header, the running easy handle will get stuck in the CURLM_STATE_PERFORM - state, leaving the external event loop stuck waiting for data from the - ingoing socket (when using the curl_multi_socket_action stuff). While this - bug was pretty hard to find, it seems to require only a one-line fix. The - break statement on line 1374 in multi.c caused the function to skip the call - to multistate(). - - How to reproduce this bug? Well, that's another question. evhiperfifo.c in - the examples directory chokes on this bug only _sometimes_, probably - depending on how fast the URLs are added. One way of testing the bug out is - writing to hiper.fifo from more than one source at the same time. - -Daniel Fandrich (7 Jan 2009) -- Unified much of the SessionHandle initialization done in Curl_open() and - curl_easy_reset() by creating Curl_init_userdefined(). This had the side - effect of fixing curl_easy_reset() so it now also resets - CURLOPT_FTP_FILEMETHOD and CURLOPT_SSL_SESSIONID_CACHE - -Daniel Stenberg (7 Jan 2009) -- Rob Crittenden did once again provide an NSS update: - - I have to jump through a few hoops now with the NSS library initialization - since another part of an application may have already initialized NSS by the - time Curl gets invoked. This patch is more careful to only shutdown the NSS - library if Curl did the initialization. - - It also adds in a bit of code to set the default ciphers if the app that - call NSS_Init* did not call NSS_SetDomesticPolicy() or set specific - ciphers. One might argue that this lets other application developers get - lazy and/or they aren't using the NSS API correctly, and you'd be right. - But still, this will avoid terribly difficult-to-trace crashes and is - generally helpful. - -Daniel Stenberg (1 Jan 2009) -- 'reconf' is removed since we rather have users use 'buildconf' - -Daniel Stenberg (31 Dec 2008) -- Bas Mevissen reported https://curl.haxx.se/bug/view.cgi?id=2479030 pointing - out that 'reconf' didn't properly point out the m4 subdirectory when running - aclocal. - -Daniel Stenberg (29 Dec 2008) - - Phil Lisiecki filed bug report #2413067 - (https://curl.haxx.se/bug/view.cgi?id=2413067) that identified a problem that - would cause libcurl to mark a DNS cache entry "in use" eternally if the - subsequence TCP connect failed. It would thus never get pruned and refreshed - as it should've been. - - Phil provided his own patch to this problem that while it seemed to work - wasn't complete and thus I wrote my own fix to the problem. - -Daniel Stenberg (28 Dec 2008) -- Peter Korsgaard fixed building libcurl with "configure --with-ssl - --disable-verbose". - -- Anthony Bryan fixed more language and spelling flaws in man pages. - -Daniel Stenberg (22 Dec 2008) -- Given a recent enough libssh2, libcurl can now seek/resume with SFTP even - on file indexes beyond 2 or 4GB. - -- Anthony Bryan provided a set of patches that cleaned up manual language, - corrected spellings and more. - -Daniel Stenberg (20 Dec 2008) -- Igor Novoseltsev fixed a bad situation for the multi_socket() API when doing - pipelining, as libcurl could then easily get confused and A) work on the - handle that was not "first in queue" on a pipeline, or even B) tell the app - to REMOVE a socket while it was in use by a second handle in a pipeline. Both - errors caused hanging or stalling applications. - -Daniel Stenberg (19 Dec 2008) -- curl_multi_timeout() could return a timeout value of 0 even though nothing - was actually ready to get done, as the internal time resolution is higher - than the returned millisecond timer. Therefore it could cause applications - running on fast processors to do short bursts of busy-loops. - curl_multi_timeout() will now only return 0 if the timeout is actually - alreay triggered. - -- Using the libssh2 0.19 function libssh2_session_block_directions(), libcurl - now has an improved ability to do right when the multi interface (both - "regular" and multi_socket) is used for SCP and SFTP transfers. This should - result in (much) less busy-loop situations and thus less CPU usage with no - speed loss. - -Daniel Stenberg (17 Dec 2008) -- SCP and SFTP with the multi interface had the same flaw: the 'DONE' - operation didn't complete properly if the EAGAIN equivalent was returned but - libcurl would simply continue with a half-completed close operation - performed. This ruined persistent connection re-use and cause some - SSH-protocol errors in general. The correction is unfortunately adding a - blocking function - doing it entirely non-blocking should be considered for - a better fix. - -Gisle Vanem (16 Dec 2008) -- Added the possibility to use the Watt-32 tcp/ip stack under Windows. - The change simply involved adding a USE_WATT32 section in the - config-win32.h files (under ./lib and ./src). This section disables - the use of any Winsock headers. - -Daniel Stenberg (16 Dec 2008) -- libssh2_sftp_last_error() was wrongly used at some places in libcurl which - made libcurl sometimes not properly abort problematic SFTP transfers. - -Daniel Stenberg (12 Dec 2008) -- More work with Igor Novoseltsev to first fix the remaining stuff for - removing easy handles from multi handles when the easy handle is/was within - a HTTP pipeline. His bug report #2351653 - (https://curl.haxx.se/bug/view.cgi?id=2351653) was also related and was - eventually fixed by a patch by Igor himself. - -Yang Tse (12 Dec 2008) -- Patrick Monnerat fixed a build regression, introduced in 7.19.2, affecting - OS/400 compilations with IPv6 enabled. - -Daniel Stenberg (12 Dec 2008) -- Mark Karpeles filed bug report #2416182 titled "crash in ConnectionExists - when using duphandle+curl_mutli" - (https://curl.haxx.se/bug/view.cgi?id=2416182) which showed that - curl_easy_duphandle() wrongly also copied the pointer to the connection - cache, which was plain wrong and caused a segfault if the handle would be - used in a different multi handle than the handle it was duplicated from. - -Daniel Stenberg (11 Dec 2008) -- Keshav Krity found out that libcurl failed to deal with dotted IPv6 - addresses if they were very long (>39 letters) due to a too strict address - validity parser. It now accepts addresses up to 45 bytes long. - -Daniel Stenberg (11 Dec 2008) -- Internet Explorer had a broken HTTP digest authentication before v7 and - there are servers "out there" that relies on the client doing this broken - Digest authentication. Apache even comes with an option to work with such - broken clients. - - The difference is only for URLs that contain a query-part (a '?'-letter and - text to the right of it). - - libcurl now supports this quirk, and you enable it by setting the - CURLAUTH_DIGEST_IE bit in the bitmask you pass to the CURLOPT_HTTPAUTH or - CURLOPT_PROXYAUTH options. They are thus individually controlled to server - and proxy. - - (note that there's no way to activate this with the curl tool yet) - -Daniel Fandrich (9 Dec 2008) -- Added test cases 1089 and 1090 to test --write-out after a redirect to - test a report that the size didn't work, but these test cases pass. - -- Documented CURLOPT_CONNECT_ONLY as being useful only on HTTP URLs. - -Daniel Stenberg (9 Dec 2008) -- Ken Hirsch simplified how libcurl does FTPS: now it doesn't assume any - particular state for the control connection like it did before for implicit - FTPS (libcurl assumed such control connections to be encrypted while some - FTPS servers such as FileZilla assumes such connections to be clear - mode). Use the CURLOPT_USE_SSL option to set your desired level. - -Daniel Stenberg (8 Dec 2008) -- Fred Machado posted about a weird FTP problem on the curl-users list and when - researching it, it turned out he got a 550 response back from a SIZE command - and then I fell over the text in RFC3659 that says: - - The presence of the 550 error response to a SIZE command MUST NOT be taken - by the client as an indication that the file cannot be transferred in the - current MODE and TYPE. - - In other words: the change I did on September 30th 2008 and that has been - included in the last two releases were a regression and a bad idea. We MUST - NOT take a 550 response from SIZE as a hint that the file doesn't exist. - -- Christian Krause filed bug #2221237 - (https://curl.haxx.se/bug/view.cgi?id=2221237) that identified an infinite - loop during GSS authentication given some specific conditions. With his - patience and great feedback I managed to narrow down the problem and - eventually fix it although I can't test any of this myself! - -Daniel Fandrich (3 Dec 2008) -- Fixed the getifaddrs version of Curl_if2ip to work on systems without IPv6 - support (e.g. Minix) - -Daniel Stenberg (3 Dec 2008) -- Igor Novoseltsev filed bug #2351645 - (https://curl.haxx.se/bug/view.cgi?id=2351645) that identified a problem with - the multi interface that occured if you removed an easy handle while in - progress and the handle was used in a HTTP pipeline. - -- Pawel Kierski pointed out a mistake in the cookie code that could lead to a - bad fclose() after a fatal error had occured. - (https://curl.haxx.se/bug/view.cgi?id=2382219) - -Daniel Fandrich (25 Nov 2008) -- If a HTTP request is Basic and num is already >=1000, the HTTP test - server adds 1 to num to get the data section to return. This allows - testing authentication negotiations using the Basic authentication - method. - -- Added tests 1087 and 1088 to test Basic authentication on a redirect - with and without --location-trusted - -Daniel Stenberg (24 Nov 2008) -- Based on a patch by Vlad Grachov, libcurl now uses a new libssh2 0.19 - function when built to support SCP and SFTP that helps the library to know - in which direction a particular libssh2 operation would return EAGAIN so - that libcurl knows what socket conditions to wait for before trying the - function call again. Previously (and still when using libssh2 0.18 or - earlier), libcurl will busy-loop in this situation when the easy interface - is used! - -Daniel Fandrich (20 Nov 2008) -- Automatically detect OpenBSD's CA cert bundle. - -Daniel Stenberg (19 Nov 2008) -- I removed the default use of "Pragma: no-cache" from libcurl when a proxy is - used. It has been used since forever but it was never a good idea to use - unless explicitly asked for. - -- Josef Wolf's extension that allows a $TESTDIR/gdbinit$testnum file that when - you use runtests.pl -g, will be sourced by gdb to allow additional fancy or - whatever you see fit - -- Christian Krause reported and fixed a memory leak that would occur with HTTP - GSS/kerberos authentication (https://curl.haxx.se/bug/view.cgi?id=2284386) - -- Andreas Wurf and Markus Koetter helped me analyze a problem that Andreas got - when uploading files to a single FTP server using multiple easy handle - handles with the multi interface. Occasionally a handle would stall in - mysterious ways. - - The problem turned out to be a side-effect of the ConnectionExists() - function's eagerness to re-use a handle for HTTP pipelining so it would - select it even if already being in use, due to an inadequate check for its - chances of being used for pipelnining. - -Daniel Fandrich (17 Nov 2008) -- Added more compiler warning options for gcc 4.3 - -Yang Tse (17 Nov 2008) -- Fix a remaining problem in the inet_pton() runtime configure check. And - fix internal Curl_inet_pton() failures to reject certain malformed literals. - -- Make configure script check if ioctl with the SIOCGIFADDR command can be - used, and define HAVE_IOCTL_SIOCGIFADDR if appropriate. - -Daniel Stenberg (16 Nov 2008) -- Christian Krause fixed a build failure when building with gss support - enabled and FTP disabled. - -- Added check for NULL returns from strdup() in src/main.c and lib/formdata.c - - reported by Jim Meyering also prevent buffer overflow on MSDOS when you do - for example -O on a url with a file name part longer than PATH_MAX letters - -- lib/nss.c fixes based on the report by Jim Meyering: I went over and added - checks for return codes for all calls to malloc and strdup that were - missing. I also changed a few malloc(13) to use arrays on the stack and a - few malloc(PATH_MAX) to instead use aprintf() to lower memory use. - -- I fixed a memory leak in Curl_nss_connect() when CURLOPT_ISSUERCERT is - in use. - -Daniel Fandrich (14 Nov 2008) -- Added .xml as one of the few common file extensions known by the multipart - form generator. - -- Added some #ifdefs around header files and change the EAGAIN test to - fix compilation on Cell (reported by Jeff Curley). - -Yang Tse (14 Nov 2008) -- Fixed several configure script issues affecting checks for inet_ntoa_r(), - inet_ntop(), inet_pton(), getifaddrs(), fcntl() and getaddrinfo(). - -Yang Tse (13 Nov 2008) -- Refactored configure script detection of functions used to set sockets into - non-blocking mode, and decouple function detection from function capability. - -Version 7.19.2 (13 November 2008) - -Michal Marek (13 Nov 2008) -- Fixed a potential data loss in Curl_client_write() when the transfer is - paused. - -Daniel Stenberg (11 Nov 2008) -- Rainer Canavan filed bug #2255627 - (https://curl.haxx.se/bug/view.cgi?id=2255627) which pointed out that a - program using libcurl's multi interface to download a HTTPS page with a - libcurl built powered by OpenSSL, would easily get silly and instead hand - over SSL details as data instead of the actual HTTP headers and body. This - happened because libcurl would consider the connection handshake done too - early. This problem was introduced at September 22nd 2008 with my fix of the - bug #2107377 - - The correct fix is now instead done within the GnuTLS-handling code, as both - the OpenSSL and the NSS code already deal with this situation in similar - fashion. I added test case 560 in an attempt to verify this fix, but - unfortunately it didn't trigger it even before this fix! - -Yang Tse (11 Nov 2008) -- Related with bug #2230535 (https://curl.haxx.se/bug/view.cgi?id=2230535) - Daniel Fandrich noticed that curl_addrinfo was also missing in the build - process of other four non-configure platforms. Added now. - -Daniel Fandrich (7 Nov 2008) -- The getifaddrs() version of Curl_if2ip() crashed when used on a Linux - system with a TEQL load-balancing device configured, which doesn't - have an address. Thanks to Adam Sampson for spotting this (bug #2234923). - -Yang Tse (6 Nov 2008) -- Merged existing IPv4 and IPv6 Curl_ip2addr functions into a single one - which now also takes a protocol address family argument. - -- Bug #2230535 (https://curl.haxx.se/bug/view.cgi?id=2230535) pointed out a - problem with MSVC 6 makefile that caused a build failure. It was noted that - the curl_addrinfo.obj reference was missing. I took the opportunity to sort - the list in which this was missing. Issue submitted by John Wilkinson. - -Version 7.19.1 (5 November 2008) - -Daniel Stenberg (4 Nov 2008) -- CURLINFO_FILETIME now works for file:// transfers as well - -Daniel Stenberg (3 Nov 2008) -- Bug #2218480 (https://curl.haxx.se/bug/view.cgi?id=2218480) pointed out a - problem with my CURLINFO_PRIMARY_IP fix from October 7th that caused a NULL - pointer read. I also took the opportunity to clean up this logic (storing of - the connection's IP address) somewhat as we had it stored in two different - places and ways previously and they are now unified. - -Yang Tse (3 Nov 2008) -- Fix undersized IPv6 address internal buffer. IPv6 address strings longer - than 35 characters would be truncated. - -Daniel Stenberg (2 Nov 2008) -- Daniel Johnson reported and fixed: - - When c-ares isn't enabled, libcurl by default calls getaddrinfo with family - set to PF_UNSPEC which causes getaddrinfo to return all available addresses, - both IPv4 and IPv6. Libcurl then tries each one until it can connect. If the - net connection doesn't support IPv6, libcurl can still fall back to IPv4. - - However, since c-ares doesn't support PF_UNSPEC, when it's used it defaults - to using family=PF_INET6 and therefore only returns IPv6 addresses when AAAA - records are available, even if IPv4 addresses are also available. The effect - is that since my ISP doesn't do IPv6, libcurl can't connect at all to a site - that has AAAA records. It will work if I explicitly use CURL_IPRESOLVE_V4 or - --ipv4 with the curl tool. I discovered this when curl would fail to connect - to seemingly random sites. It turns out they weren't random, they were sites - with AAAA records. - - So now libcurl defaults to PF_INET... until c-ares has been tought to offer - both. - -Yang Tse (31 Oct 2008) -- Tests 558 and 559 are stabilized. These two tests were initially introduced - to aid in the location of a seg-fault which was only triggered on non-debug - builds done with the icc 9.1 Intel compiler. Test 558 does not trigger the - problem, but test 559 does trigger it. As of today, it isn't yet absolutely - clear if it is a compiler optimizer issue or a memory corruption one. - -Yang Tse (30 Oct 2008) -- Use our Curl_addrinfo structure definition to handle address info data even - when a system addrinfo struct is available. Provide and use a wrapper around - systems getaddrinfo function, Curl_getaddrinfo_ex which returns a pointer to - a list of dynamically allocated Curl_addrinfo structs. - - Configure will check freeaddrinfo and getaddrinfo functions and define - preprocessor symbols HAVE_FREEADDRINFO and HAVE_GETADDRINFO when appropriate. - -Daniel Fandrich (29 Oct 2008) -- Fixed a bug that caused a few bytes of garbage to be sent after a - curl_easy_pause() during a chunky upload. Reported by Steve Roskowski. - -Daniel Fandrich (28 Oct 2008) -- Changed the "resolve" test precheck program to verify that an IPv6 socket - can be created before resolving the IPv6 name. In the context of running - a test, it doesn't make sense to run an IPv6 test when a host is resolvable - but IPv6 isn't usable. This should fix failures of test 1085 on hosts with - library and DNS support for IPv6 but where actual use of IPv6 has been - administratively disabled. - -Daniel Fandrich (24 Oct 2008) -- Added experimental support for zlib and OpenSSL on Symbian OS. - -Daniel Fandrich (21 Oct 2008) -- Fixed some problems with SFTP range support to fix test cases 634 through - 637. - -Daniel Fandrich (17 Oct 2008) -- Fixed a compile error reported by Albert Chin on AIX and IRIX when using - GTLS. - -Daniel Stenberg (16 Oct 2008) -- Igor Novoseltsev added CURLOPT_PROXYUSER and CURLOPT_PROXYPASSWORD that then - make CURLOPT_PROXYUSERPWD sort of deprecated. The primary motive for adding - these new options is that they have no problems with the colon separator - that the CURLOPT_PROXYUSERPWD option does. - -Daniel Stenberg (15 Oct 2008) -- Pascal Terjan filed bug #2154627 - (https://curl.haxx.se/bug/view.cgi?id=2154627) which pointed out that libcurl - uses strcasecmp() in multiple places where it causes failures when the - Turkish locale is used. This is because 'i' and 'I' isn't the same letter so - strcasecmp() on those letters are different in Turkish than in English (or - just about all other languages). I thus introduced a totally new internal - function in libcurl (called Curl_raw_equal) for doing case insentive - comparisons for english-(ascii?) style strings that thus will make "file" - and "FILE" match even if the Turkish locale is selected. - -Daniel Fandrich (15 Oct 2008) -- A <precheck> command is considered to have failed if it returns a non-zero - return code. This way, if the precheck command can't be run at all for - whatever reason, it's treated as a precheck failure which causes the - test to be skipped. - -Daniel Stenberg (15 Oct 2008) -- John Wilkinson filed bug #2155496 - (https://curl.haxx.se/bug/view.cgi?id=2155496) pointing out an error case - without a proper human-readable error message. When a read callback returns - a too large value (like when trying to return a negative number) it would - trigger and the generic error message then makes the proplem slightly - different to track down. I've added an error message for this now. - -Daniel Fandrich (9 Oct 2008) -- Fixed the --interface option to work with IPv6 connections on glibc - systems supporting getifaddrs(). Also fixed a problem where an IPv6 - address could be chosen instead of an IPv4 one for --interface when it - involved a name lookup. - -Daniel Fandrich (8 Oct 2008) -- Added tests 1082 through 1085 to test symbolic --interface parameters - -- Added tests 633 through 637 to test the new file range support for SFTP. - All but the first test cause an infinite loop or other failure and so - are added to DISABLED. - -Daniel Stenberg (8 Oct 2008) -- John Wilkinson filed bug #2152270 - (https://curl.haxx.se/bug/view.cgi?id=2152270) which identified and fixed a - CURLINFO_REDIRECT_URL memory leak and an additional wrong-doing: - - Any subsequent transfer with a redirect leaks memory, eventually crashing - the process potentially. - - Any subsequent transfer WITHOUT a redirect causes the most recent redirect - that DID occur on some previous transfer to still be reported. - -- Igor Novoseltsev filed bug #2111613 - (https://curl.haxx.se/bug/view.cgi?id=2111613) that eventually identified a - flaw in how the multi_socket interface in some cases missed to call the - timeout callback when easy interfaces are removed and added within the same - millisecond. - -- Igor Novoseltsev brought a patch that introduced two new options to - curl_easy_setopt: CURLOPT_USERNAME and CURLOPT_PASSWORD that sort of - deprecates the good old CURLOPT_USERPWD since they allow applications to set - the user name and password independently and perhaps more importantly allow - both to contain colon(s) which CURLOPT_USERPWD doesn't fully support. - -Daniel Fandrich (7 Oct 2008) -- Changed the handling of read/write errors in Curl_perform() to allow a - a fresh connection to be made in such cases and the request retransmitted. - This should fix test case 160. Added test case 1079 in an attempt to - test a similar connection dropping scenario, but as a race condition, it's - hard to test reliably. - -- Created test cases 1080 and 1081 to reproduce a problem of - CURLINFO_REDIRECT_URL leaking memory and returning incorrect results when - two URLs are requested. Reported by vmpdemo in bug #2152270 - -Daniel Stenberg (7 Oct 2008) -- Fixed CURLINFO_PRIMARY_IP: When libcurl created a connection to host A then - the app re-used the handle to do a connection to host B and then again - re-used the handle to host A, it would not update the info with host A's IP - address (due to the connection being re-used) but it would instead report - the info from host B. - -Yang Tse (7 Oct 2008) -- Added --enable-optimize configure option to enable and disable compiler - optimizations to allow decoupled setting from --enable-debug. - -Yang Tse (2 Oct 2008) -- Added --enable-warnings configure option to enable and disable strict - compiler warnings to allow decoupled setting from --enable-debug. - - runtests.pl will now run with picky compiler warnings enabled unless - explicitly disabled. - -Daniel Fandrich (1 Oct 2008) -- "make clean" now cleans out the docs and tests directories, too. - -Daniel Stenberg (30 Sep 2008) -- The libcurl FTP code now returns CURLE_REMOTE_FILE_NOT_FOUND error when SIZE - gets a 550 response back for the cases where a download (or NOBODY) is - wanted. It still allows a 550 as response if the SIZE is used as part of an - upload process (like if resuming an upload is requested and the file isn't - there before the upload). I also modified the FTP test server and a few test - cases accordingly to match this modified behavior. - -Daniel Stenberg (29 Sep 2008) -- Daniel Egger provided a patch that allows you to disable proxy support in - libcurl to somewhat reduce the size of the binary. Run configure - --disable-proxy. - -Daniel Fandrich (29 Sep 2008) -- Moved all signal-based name resolution timeout handling into a single new - Curl_resolv_timeout function to reduce coupling. - -Daniel Stenberg (29 Sep 2008) -- Ian Lynagh provided a patch that now makes CURLOPT_RANGE work fine for SFTP - downloads! - -- Maxim Ivanov filed bug report #2107803 - (https://curl.haxx.se/bug/view.cgi?id=2107803) "no CURLINFO_REDIRECT_URL in - multi mode" together with a patch that fixed the problem. - -Daniel Stenberg (25 Sep 2008) -- Emanuele Bovisio submitted bug report #2126435. We fixed the HTTP Digest - auth code to not behave badly when getting a blank realm with - realm="". https://curl.haxx.se/bug/view.cgi?id=2126435 - -Daniel Fandrich (23 Sep 2008) -- Make sure not to dereference the wrong UrlState proto union member when - switching from one protocol to another in a single request (e.g. - redirecting from HTTP to FTP as in test 1055) by resetting - state.expect100header before every request. - -Daniel Stenberg (23 Sep 2008) -- Introducing Jamie Lokier's function for date to epoch conversion used in the - date parser function. This makes our function less dependent on system- - provided functions and instead we do all the magic ourselves. We also no - longer depend on the TZ environment variable. Switching to our own converter - has some side-effect and they are noted here for future reference (taken - from a mail by mr Lokier): - - time_t is not measured in seconds in the ANSI C standard - or even counted - uniformly - weird platforms can use other numeric representations of dates - in time_t - hence the difftime() function. - - On POSIX time_t is measured in UTC seconds, which means not including leap - seconds. But it's mentioned in a few places that some old POSIX-ish - environments include leap seconds in their time_t counts... - - I'm pretty sure [the new implementation is] correct on anything truly POSIX. - And it's obviously a lot less dependent on platform quirks and corner cases - in many ways than the mktime() version. - -- Rob Crittenden brought a patch to "add some locking for thread-safety to NSS - implementation". - -Daniel Stenberg (22 Sep 2008) -- Made the SOCKS code use the new Curl_read_plain() function to fix the bug - Markus Moeller reported: https://curl.haxx.se/mail/archive-2008-09/0016.html - -- recv() errors other than those equal to EAGAIN now cause proper - CURLE_RECV_ERROR to get returned. This made test case 160 fail so I've now - disabled it until we can figure out another way to exercise that logic. - -- Michael Goffioul filed bug report #2107377 "Problem with multi + GnuTLS + - proxy" (https://curl.haxx.se/bug/view.cgi?id=2107377) that showed how a multi - interface using program didn't work when built with GnuTLS and a CONNECT - request was done over a proxy (basically test 502 over a proxy to a HTTPS - site). It turned out the ssl connect function would get called twice which - caused the second call to fail. - -Daniel Fandrich (22 Sep 2008) -- Fixed test 539 to handle an out of memory condition that shows up now - that memdebug.h is included in the test programs. - -Yang Tse (20 Sep 2008) -- Fix regression in configure script which affected OpenSSL builds on MSYS. - -Yang Tse (19 Sep 2008) -- configure script now checks availability of the alarm() function. - -Daniel Fandrich (18 Sep 2008) -- Don't bother to install a SIGALRM handler unless alarm() is available. - Also, leave the existing SIGALRM handler alone if the timeout is too small - to handle. - -Daniel Fandrich (17 Sep 2008) -- Removed reference to curl-ca-bundle.crt in the host verification failure - error message. - -Yang Tse (17 Sep 2008) -- Improve configure detection of gethostname(), localtime_r(), strstr(), - getservbyport_r(), gethostbyaddr_r() and gethostbyname_r(). - -Yang Tse (14 Sep 2008) -- Improve configure detection of strcasecmp(), strcasestr(), strcmpi(), - stricmp(), strlcat(), strncasecmp(), strncmpi() and strnicmp(). - -Yang Tse (13 Sep 2008) -- Disable tracking of fdopen() calls in the low-level memory leak tracking - code when fdopen() is not available, to avoid compiler error. - -Yang Tse (12 Sep 2008) -- Further adjust detection of strerror_r() in the configure process, and - ensure that errno is not modified inside Curl_strerror(). - -Yang Tse (10 Sep 2008) -- Improve detection of gmtime_r(), strtoll(), sigaction(), strtok_r(), - strdup() and ftruncate() in the configure process. - -Daniel Fandrich (9 Sep 2008) -- Mike Revi discovered some swapped speed switches documented in the curl man - page. - -- Checked in some documentation and code improvements and fixes that I - discovered in the FreeBSD ports system. - -Daniel Stenberg (8 Sep 2008) -- Dmitry Kurochkin patched a problem: I have found bug in pipelining through - proxy. I have a transparent proxy. When running with http_proxy environment - variable not set my test completes fine (it goes through transparent - proxy). When I set http_proxy variable my test hangs after the first - downloaded is complete. Looks like the second handle never gets out from - WAITDO state. - - The fix: It makes checkPendPipeline move 1 handler from pend pipe to send - pipe if pipelining is not supported by server but there are no handles in - send and recv pipes. - -- Stefan Krause pointed out that libcurl would wrongly send away cookies to - sites in cases where the cookie clearly has a very old expiry date. The - condition was simply that libcurl's date parser would fail to convert the - date and it would then count as a (timed-based) match. Starting now, a - missed date due to an unsupported date format or date range will now cause - the cookie to not match. - -Daniel Fandrich (5 Sep 2008) -- Improved the logic that decides whether to use HTTP 1.1 features or not in a - request. Setting a specific version with CURLOPT_HTTP_VERSION overrides - all other checks, but otherwise, a 1.0 request will be made if the server - is known to support only 1.0 because it previously responded so and the - connection was kept alive, or a response to a previous request on this handle - came back as 1.0. The latter could take place in cases like redirection or - authentication where several requests have to be made before the operation - is complete. If any one of the servers in a redirection chain supports only - 1.0, then remaining requests will be sent in 1.0 mode. - -- Detect cases where an upload must be sent chunked and the server supports - only HTTP 1.0 and return CURLE_UPLOAD_FAILED. - -Daniel Stenberg (5 Sep 2008) -- Martin Drasar provided the CURLOPT_POSTREDIR patch. It renames - CURLOPT_POST301 (but adds a define for backwards compatibility for you who - don't define CURL_NO_OLDIES). This option allows you to now also change the - libcurl behavior for a HTTP response 302 after a POST to not use GET in the - subsequent request (when CURLOPT_FOLLOWLOCATION is enabled). I edited the - patch somewhat before commit. The curl tool got a matching --post302 - option. Test case 1076 was added to verify this. - -- Introducing CURLOPT_CERTINFO and the corresponding CURLINFO_CERTINFO. By - enabling this feature with CURLOPT_CERTINFO for a request using SSL (HTTPS - or FTPS), libcurl will gather lots of server certificate info and that info - can then get extracted by a client after the request has completed with - curl_easy_getinfo()'s CURLINFO_CERTINFO option. Linus Nielsen Feltzing - helped me test and smoothen out this feature. - - Unfortunately, this feature currently only works with libcurl built to use - OpenSSL. - - This feature was sponsored by networking4all.com - thanks! - -- Dmitriy Sergeyev pointed out that curl_easy_pause() didn't unpause properly - during certain conditions. I also changed this code to use realloc() based - on Daniel Fandrich's suggestion. - -Guenter Knauf (4 Sep 2008) -- MingW32 non-configure builds are now largefile feature enabled by default. - NetWare LIBC builds are also now largefile feature enabled by default. - -Yang Tse (4 Sep 2008) -- Several fixes related with print formatting string directives. - -Daniel Fandrich (3 Sep 2008) -- Search for the FreeBSD CA cert file /usr/local/share/certs/ca-root.crt - -Daniel Fandrich (2 Sep 2008) -- Fixed an out of memory problem that caused torture test failures in tests - 706 and 707. - -Daniel Stenberg (2 Sep 2008) -- Keith Mok added supported_protocols and supported_features to the pkg-config - file for libcurl, and while doing that fix he unified with curl-config.in - how the supported protocols and features are extracted and used, so both those - tools should now always be synced. - -Version 7.19.0 (1 September 2008) - -Daniel Fandrich (29 Aug 2008) -- Added tests 1071 through 1074 to test automatic downgrading from HTTP 1.1 - to HTTP 1.0 upon receiving a response from the HTTP server. Tests 1072 - and 1073 are similar to test 1069 in that they involve the impossible - scenario of sending chunked data to a HTTP 1.0 server. All these fail - and are added to DISABLED. - -- Added test 1075 to test --anyauth with Basic authentication. - -Daniel Stenberg (29 Aug 2008) -- When libcurl was doing a HTTP POST and the server would respond with - "Connection: close" and actually close the connection after the - response-body, libcurl could still have outstanding data to send and it - would not properly notice this and stop sending. This caused weirdness and - sad faces. https://curl.haxx.se/bug/view.cgi?id=2080222 - - Note that there are still reasons to consider libcurl's behavior when - getting a >= 400 response code while sending data, as Craig Perras' note - "http upload: how to stop on error" specifies: - https://curl.haxx.se/mail/archive-2008-08/0138.html - -Daniel Stenberg (28 Aug 2008) -- Dengminwen reported that libcurl would lock a (cookie) share twice (without - an unlock in between) for a certain case and that in fact works when using - regular windows mutexes but not with pthreads'! Locks should of course not - get locked again so this is now fixed. - https://curl.haxx.se/mail/lib-2008-08/0422.html - -- I'm abandoning the system with the web site mirrors (but keeping download - files bing mirrored) and thus I've changed the URL in the cookiejar header - to no longer use curlm.haxx.se but instead use the main site curl.haxx.se - -Daniel Fandrich (27 Aug 2008) -- Fixed test case 1065 by changing the handling of CURLOPT_UPLOAD to set - the HTTP method to GET (or HEAD) when given a value of 0. - -- Added test cases 1068 and 1069 to test a simple HTTP PUT from stdin. Test - case 1069 fails in a similar manner to test 1065 so is added to DISABLED. - -Yang Tse (27 Aug 2008) -- Fix generation of MS VC6 .dsp file to make it support compilation of either - dynamic (DLL) or static (LIB) libcurl libraries in debug and release modes. - -Daniel Fandrich (26 Aug 2008) -- Fixed out of memory problems that caused torture test failures in tests - 1021 and 1067. - -Yang Tse (26 Aug 2008) -- Added check and symbol definition for WIN32 file API usage in configure, - supporting configure's --disable-largefile option for WIN32 targets also. - -- Non-configure systems which do not use config-win32.h configuration file, - and want to use the WIN32 file API, must define USE_WIN32_LARGE_FILES or - USE_WIN32_SMALL_FILES as appropriate in their own configuration files. - -Daniel Stenberg (23 Aug 2008) -- Running 'make ca-firefox' in the root build dir will now run the new - firefox-db2pem.sh conversion script that converts a local Firefox db of ca - certs into PEM format, suitable for use with a OpenSSL or GnuTLS built - libcurl. - -- Constantine Sapuntzakis fixed a bug when doing proxy CONNECT with the multi - interface, and the proxy would send Connection: close during the - authentication phase. https://curl.haxx.se/bug/view.cgi?id=2069047 - -Daniel Fandrich (22 Aug 2008) -- Fixed a problem when --dump-header - was given with more than one URL, - which caused an error when the second header was dumped due to stdout - being closed. Added test case 1066 to verify. Also fixed a potential - problem where a closed file descriptor might be used for an upload - when more than one URL is given. - -Yang Tse (22 Aug 2008) -- Improved libcurl's internal curl_m*printf() functions integral data type - size and signedness handling. - -- Internal adjustments to better select/differentiate when large/small file - support is provided using WIN32 functions directly. - -Daniel Fandrich (20 Aug 2008) -- Added an edited version of Vincent Le Normand's documentation of SFTP quote - commands to the man pages. - -Daniel Stenberg (20 Aug 2008) -- Phil Pellouchoud pointed out that the windows version of libcurl had a - memory leak because it never called the OpenSSL function - CRYPTO_cleanup_all_ex_data() as it was supposed to. This was because of a - missing define in config-win32.h! - -Gisle Vanem (18 Aug 2008) -- Updated lib/Makefile.Watcom with the option to use c-ares (USE_ARES=1). - -Yang Tse (18 Aug 2008) -- Added test case 557 to verify libcurl's internal curl_m*printf() functions - formatting functionality when handling signed and unsigned longs, as well as - our curl_off_t data type. - -Yang Tse (17 Aug 2008) -- OpenSSl enabled NetWare builds are changed to use the 'openssl' subdirectory - when including the OpenSSL header files. This is the recommended setting, this - prevents the undesired inclusion of header files with the same name as those - of OpenSSL but which do not belong to the OpenSSL package. The visible change - from previously released libcurl versions is that now OpenSSl enabled NetWare - builds also define USE_OPENSSL in config files, and that OpenSSL header files - must be located in a subdirectory named 'openssl'. - -Yang Tse (16 Aug 2008) -- Library internal only C preprocessor macros FORMAT_OFF_T and FORMAT_OFF_TU - remain in use as internal curl_off_t print formatting strings for the internal - *printf functions which still cannot handle print formatting string directives - such as "I64d", "I64u", and others available on MSVC, MinGW, Intel's ICC, and - other DOS/Windows compilers. - -Daniel Fandrich (15 Aug 2008) -- Added test case 1063 to test invalid long file ranges with file: URLs and - 1064 to test multiple http PUTs. - -- Added test case 1065 to test a PUT with a single file but two URLs. This - was discovered to be problematic while investigating an incident reported by - Von back in May. curl in this case doesn't include a Content-Length: or - Transfer-Encoding: chunked header which is illegal. This test case is - added to DISABLED until a solution is found. - -Yang Tse (15 Aug 2008) -- C preprocessor macros used internally and equally available externally which - aid in the use of the curl_off_t data type are named: CURL_FORMAT_CURL_OFF_T, - CURL_FORMAT_CURL_OFF_TU, CURL_SIZEOF_CURL_OFF_T, CURL_SUFFIX_CURL_OFF_T, - CURL_SUFFIX_CURL_OFF_TU, CURL_OFF_T_C and CURL_OFF_TU_C. - -Yang Tse (13 Aug 2008) -- The size of long is a build time characteristic and as such it is now recorded - in curlbuild.h as CURL_SIZEOF_LONG. Definition now done from configure process - and in CVS curlbuild.h.dist for non-configure systems. - -Daniel Fandrich (12 Aug 2008) -- Fixed a buffer overflow problem in Curl_proxyCONNECT that could occur - when a server responded with long headers and data. Luckily, the buffer - overflowed into another unused buffer, so no actual harm was done. - Added test cases 1060 and 1061 to verify. - -Daniel Stenberg (12 Aug 2008) -- Andy Tsouladze fixed runtests.pl to not attempt to execute the stunnel - _directory_ if that happened to appear in the path! - -Yang Tse (12 Aug 2008) -- Added macros for minimum-width signed and unsigned curl_off_t integer - constants CURL_OFF_T_C and CURL_OFF_TU_C. The clever double helper macro - used internally to provide its functionality is thanks to Lars Nilsson. - -Daniel Fandrich (11 Aug 2008) -- Fixed a boundary condition error in ftp_readresp() whereby a non-terminal - line of a multiline FTP response whose last byte landed exactly at the end - of the BUFSIZE-length buffer would be treated as the terminal response - line. The following response code read in would then actually be the - end of the previous response line, and all responses from then on would - correspond to the wrong command. Test case 1062 verifies this. - -- Stop closing a never-opened ftp socket. - -Daniel Stenberg (11 Aug 2008) -- Constantine Sapuntzakis filed bug report #2042430 - (https://curl.haxx.se/bug/view.cgi?id=2042430) with a patch. "NTLM Windows - SSPI code is not thread safe". This was due to libcurl using static - variables to tell wether to load the necessary SSPI DLL, but now the loading - has been moved to the more suitable curl_global_init() call. - -- Constantine Sapuntzakis filed bug report #2042440 - (https://curl.haxx.se/bug/view.cgi?id=2042440) with a patch. He identified a - problem when using NTLM over a proxy but the end-point does Basic, and then - libcurl would do wrong when the host sent "Connection: close" as the proxy's - NTLM state was erroneously cleared. - -Yang Tse (11 Aug 2008) -- Added missing signed and unsigned curl_off_t integer constant suffixes for - internal and external use. CURL_SUFFIX_CURL_OFF_T, CURL_SUFFIX_CURL_OFF_TU. - -Daniel Fandrich (7 Aug 2008) -- Fixed an uninitialized variable in multi_runsingle() that could cause a - request to prematurely end. - -- Added test1059 to test the FTP proxy tunnel problem fixed July 11. - -Yang Tse (7 Aug 2008) -- Added curlbuild.h and curlrules.h header files to libcurl's public headers. - File curlbuild.h is a generated file on configure-capable systems. This is - a first step towards configure-based info in public headers. Currently only - used to provide support for a curl_off_t data type which is not gated to - off_t. Further details are documented inside these mentioned header files. - -- Fix CURL_CHECK_DEF so that when the expansion of the preprocessor symbol - results in a set of double-quoted strings, this macro will now return an - expansion which consists of a single double-quoted string as the result of - concatenating all of them. - -- Skip data type check in DO_CURL_OFF_T_CHECK macro when argument is empty. - -- Adjusted testcurl.pl to copy checked out curlbuild.h.dist as curlbuild.h - for non-configure targets when the host system doesn't run buildconf.bat. - -- Prevent buildconf from removing 'Makefile' and 'missing' files. This would - blow away our CVS checked files 'missing' and 'hiper/Makefile'. - -- Remove adjustment done to testcurl.pl to verify if change introduced by - Guenter Knauf in lib/Makefile.netware is enough to get the netware autobuilds - going again. - -Yang Tse (5 Aug 2008) -- Changes done to buildconf script. Validate that autom4te and autoconf, as - well as aclocal and automake, versions match. Improve removal of previous - run generated files. Remove verbose debug logging of aclocal on Solaris. - -Daniel Stenberg (5 Aug 2008) -- Yehoshua Hershberg found a problem that would make libcurl re-use a - connection with the multi interface even if a previous use of it caused a - CURLE_PEER_FAILED_VERIFICATION to get returned. I now make sure that failed - SSL connections properly close the connections. - -Daniel Stenberg (4 Aug 2008) -- Test cases 1051, 1052 and 1055 were added by Daniel Fandrich on July 30 and - proved how PUT and POST with a redirect could lead to a "hang" due to the - data stream not being rewound properly when it had to in order to get sent - properly (again) to the subsequent URL. This is now fixed and these test - cases are no longer disabled. - -Yang Tse (4 Aug 2008) -- Autoconf 2.62 has changed the behaviour of the AC_AIX macro which we use. - Prior versions of autoconf defined _ALL_SOURCE if _AIX was defined. 2.62 - version of AC_AIX defines _ALL_SOURCE and other four preprocessor symbols - no matter if the system is AIX or not. To keep the traditional behaviour, - and an uniform one across autoconf versions AC_AIX is replaced with our - own internal macro CURL_CHECK_AIX_ALL_SOURCE. - -Daniel Stenberg (4 Aug 2008) -- Test case 1041 (added by Daniel Fandrich July 14th) proved a bug where PUT - with -C - sent garbage in the Content-Range: header. I fixed this problem by - making sure libcurl always sets the size of the _entire_ upload if an app - attemps to do resumed uploads since libcurl simply cannot know the size of - what is currently at the server end. Test 1041 is no longer disabled. - -Yang Tse (2 Aug 2008) -- No longer test availability of the gdi32 library, nor use it for linking, even - when we have been doing this since revision 1.47 of configure.ac 4 years and - 5 months ago when cross-compiling a Windows target. We actually don't use any - function from the Windows GDI (Graphics Device Interface) related with drawing - or graphics-related operations. - -Daniel Fandrich (1 Aug 2008) -- Added support for --append on SFTP uploads. Unfortunately, OpenSSH doesn't - support this so it goes untested. - -Yang Tse (1 Aug 2008) -- Configure process now checks if the preprocessor _REENTRANT symbol is already - defined. If it isn't currently defined a set of checks are performed to test - if its definition is required to make visible to the compiler a set of *_r - functions. Finally, if _REENTRANT is already defined or needed it takes care - of making adjustments necessary to ensure that it is defined equally for the - configure process tests and generated config file. - -- Removed definition of CURL_CHECK_WORKING_RESOLVER from acinclude.m4 it has - not been in use since revision 1.81 of configure.in 6 years, 9 months ago. - -Daniel Fandrich (31 Jul 2008) -- Fixed parsing of an IPv6 proxy address to support a scope identifier, - as well as IPv4 addresses in IPv6 format. Also, better handle the case - of a malformatted IPv6 address (avoid empty and NULL strings). - -- Fixed a problem with any FTP URL or any URLs containing an IPv6 address - being mangled when passed to proxies when CURLOPT_PORT is also set - (reported by Pramod Sharma). - -- User names embedded in proxy URLs without a password were parsed - incorrectly--the host name is treated as part of the user name and the - port number becomes the password. This can be observed in test 279 - (was KNOWN_ISSUE #54). - -Daniel Stenberg (30 Jul 2008) -- Phil Blundell added the CURLOPT_ADDRESS_SCOPE option, as well as adjusted - the URL parser to allow numerical IPv6-addresses to be specified with the - scope given, as per RFC4007 - with a percent letter that itself needs to be - URL escaped. For example, for an address of fe80::1234%1 the HTTP URL is: - "http://[fe80::1234%251]/" - -- PHP's bug report #43158 (http://bugs.php.net/bug.php?id=43158) identifies a - true bug in libcurl built with OpenSSL. It made curl_easy_getinfo() more or - less always return 0 for CURLINFO_SSL_VERIFYRESULT because the function that - would set it to something non-zero would return before the assign in almost - all error cases. The internal variable is now set to non-zero from the start - of the function only to get cleared later on if things work out fine. - -- Made the curl tool's -w option support the %{ssl_verify_result} variable - -Daniel Fandrich (30 Jul 2008) -- Added test cases 1052 through 1055 to test uploading data from files - during redirects. Test cases 1052 and 1055 show problems (maybe the same - root cause as 1051) and are disabled. - -- Fixed a couple of buffer overflows in the MS-DOS port of the curl tool. - -Daniel Fandrich (29 Jul 2008) -- Fixed --use-ascii to properly convert text files on Symbian OS, MS-DOS - and OS/2. - -- Added test case 1051 to test Location: following with PUT, as reported - by Ben Sutcliffe. The test when run manually shows a problem in curl - so it's disabled. - -Daniel Fandrich (28 Jul 2008) -- Fixed display of the interface bind address in the trace output when it's - an IPv6 address. - -- Added test cases 1045 through 1049 as simple tests of --interface using the - localhost interface. - -- Added test case 1050 to test --ftp-port with an IPv6 address - -Daniel Stenberg (26 Jul 2008) -- David Bau filed bug report #2026240 "CURL_READFUNC_PAUSE leads to buffer - overrun" (https://curl.haxx.se/bug/view.cgi?id=2026240) identifying two - problems, and providing the fix for them: - - - CURL_READFUNC_PAUSE did in fact not pause the _sending_ of data that it is - designed for but paused _receiving_ of data! - - - libcurl didn't internally set the read counter to zero when this return - code was detected, which would potentially lead to junk getting sent to - the server. - -Daniel Fandrich (26 Jul 2008) -- Added test 1044 to test large file support in ftp with -I. - -- Eliminate a unnecessary socket creation in Curl_getaddrinfo for an IPv4 - address in an IPv6 capable libcurl. - -- Added feature in runtests.pl to select tests based on key word. - -Daniel Fandrich (23 Jul 2008) -- Changed the long logfile elision code in runtests.pl to properly handle - lines ending in \r. - -- Changed references to TRUE and FALSE in the curl_easy_setopt man page to - 1 and zero, respectively, since TRUE and FALSE aren't part of the - libcurl API. - -Daniel Stenberg (23 Jul 2008) -- I went over the curl_easy_setopt man page and replaced most references to - non-zero with the fixed value of 1. We should strive at making options - support '1' for enabling them mentioned explicitly, as that then will allow - us for to extend them in the future without breaking older programs. - - Possibly we should even introduce a fancy define to use instead of '1' all - over... - -Yang Tse (21 Jul 2008) -- Use the sreadfrom() wrapper to replace recvfrom() in our code. - -Yang Tse (20 Jul 2008) -- when recvfrom prototype uses a void pointer for arguments 2, 5 or 6 this will - now cause the definition, as appropriate, of RECVFROM_TYPE_ARG2_IS_VOID, - RECVFROM_TYPE_ARG5_IS_VOID or RECVFROM_TYPE_ARG6_IS_VOID. - -Yang Tse (17 Jul 2008) -- RECVFROM_TYPE_ARG2, RECVFROM_TYPE_ARG5 and RECVFROM_TYPE_ARG6 are now defined - to the data type pointed by its respective argument and not the pointer type. - -Yang Tse (16 Jul 2008) -- Configure process now checks availability of recvfrom() socket function and - finds out its return type and the types of its arguments. Added definitions - for non-configure systems config files, and introduced macro sreadfrom which - will be used on udp sockets as a recvfrom() wrapper. - -Yang Tse (15 Jul 2008) -- Added description/comment to include paths used in several Makefile.am files. - Added automake option nostdinc to test servers makefile and modified libcurl - external headers include path for libtest programs. - -Daniel Fandrich (14 Jul 2008) -- Added test1040 through test1043 to test -C - on HTTP. Test 1041 failed so - it's added to DISABLED. - -Yang Tse (14 Jul 2008) -- HTTP_ONLY definition check in lib/setup.h is now done once that configuration - file has been included. In this way if symbol is defined in the config file - it will no longer be ignored. Removed inclusion of remaining system header - files from configuration files. Moved _REENTRANT definition up/earlier in - lib/setup.h - -Yang Tse (11 Jul 2008) -- Added missing multiple header inclusion prevention definition for header - file content_encoding.h - -Daniel Fandrich (11 Jul 2008) -- Fixed test 553 to pass the torture test. - -Daniel Stenberg (11 Jul 2008) -- Daniel Fandrich found out we didn't pass on the user-agent properly when - doing "proxy-tunnels" with non-HTTP prototols and that was simply because - the code assumed the user-agent was only needed for HTTP. - -Daniel Fandrich (10 Jul 2008) -- Changed slightly the SFTP quote commands chmod, chown and chgrp to only - set the attribute that has changed instead of all possible ones. Hopefully, - this will solve the "Permission denied" problem that Nagarajan Sreenivasan - reported when setting some modes, but regardless, it saves a protocol - round trip in the chmod case. - -- Added test cases 1038 and 1039 to test Adrian Kreher's report that ftp - uploads with -C - didn't resume properly, but the tests pass. - -Yang Tse (10 Jul 2008) -- Peter Lamberg filed bug report #2015126: "poll gives WSAEINVAL when POLLPRI - is set in fdset.events" (https://curl.haxx.se/bug/view.cgi?id=2015126) which - exactly pinpointed the problem only triggered on Windows Vista, provided - reference to docs and also a fix. There is much work behind Peter Lamberg's - excellent bug report. Thank You! - -Daniel Fandrich (9 Jul 2008) -- Added tests 1036 and 1037 to verify resumed ftp downloads with -C - - -Daniel Stenberg (9 Jul 2008) -- Andreas Schuldei improved Phil Blundell's patch for IPv6 using c-ares, and I - edited it slightly. Now you should be able to use IPv6 addresses fine even - with libcurl built to use c-ares. - -Daniel Fandrich (9 Jul 2008) -- Fixed an OOM handling problem that cause test 11 to fail the torture test. - -Daniel Fandrich (8 Jul 2008) -- Fixed test 554 to pass the torture test. - -Daniel Fandrich (7 Jul 2008) -- Added test cases 1034 & 1035 to test IDN name conversion failures. - -Daniel Stenberg (7 Jul 2008) -- Scott Barrett provided a test case for a segfault in the FTP code and the - fix for it. It occured when you did a FTP transfer using - CURLFTPMETHOD_SINGLECWD and then did another one on the same easy handle but - switched to CURLFTPMETHOD_NOCWD. Due to the "dir depth" variable not being - cleared properly. Scott's test case is now known as test 539 and it - verifies the fix. - -Daniel Stenberg (3 Jul 2008) -- Phil Blundell provided a fix for libcurl's treatment of unexpected 1xx - response codes. Previously libcurl would hang on such occurances. I added - test case 1033 to verify. - -- Introcuding a new timestamp for curl_easy_getinfo(): - CURLINFO_APPCONNECT_TIME. This is set with the "application layer" - handshake/connection is completed. Which typically is SSL, TLS or SSH and by - using this you can figure out the application layer's own connect time. You - can extract the time stamp using curl's -w option and the new variable named - 'time_appconnect'. This feature was sponsored by Lenny Rachitsky at NeuStar. - -Daniel Fandrich (2 Jul 2008) -- Support Open Watcom C on Linux (as well as Windows). - -Yang Tse (2 Jul 2008) -- The previously committed fix for bug report #1999181 prevented using the - monotonic clock on any system without an always supported POSIX compliant - implementation. Now the POSIX compliant configuration check is removed and - will fallback to gettimeofday when the monotonic clock is unavailable at - run-time. - -- The configure process will now halt when sed, grep, egrep or ar programs - can not be found among the directories in PATH variable. - -Daniel Stenberg (1 Jul 2008) -- Rolland Dudemaine provided fixes to get libcurl to build for the INTEGRITY - operating system. - -Daniel Stenberg (30 Jun 2008) -- Made the internal printf() support %llu properly to print unsigned long longs. - -- Stephen Collyer and Tor Arntsen helped identify a flaw in the range code - which output the range using a signed variable where it should rather use - unsigned. - -Yang Tse (29 Jun 2008) -- John Lightsey filed bug report #1999181: "CLOCK_MONOTONIC always fails on - some systems" (https://curl.haxx.se/bug/view.cgi?id=1999181). The problem was - that the configure script did not use the _POSIX_MONOTONIC_CLOCK feature test - macro when checking monotonic clock availability. This is now fixed and the - monotonic clock will not be used unless the feature test macro is defined - with a value greater than zero indicating always supported. - -Daniel Fandrich (25 Jun 2008) -- Honour --stderr with the -v option. - -- Fixed a file handle leak in the command line client if more than one - --stderr option was given. - -Daniel Stenberg (22 Jun 2008) -- Eduard Bloch filed the debian bug report #487567 - (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=487567) pointing out that - libcurl used Content-Range: instead of Range when doing a range request with - --head (CURLOPT_NOBODY). This is now fixed and test case 1032 was added to - verify. - -Daniel Fandrich (21 Jun 2008) -- Stopped using ranges in scanf character sequences (e.g. %[a-z]) since that - is not ANSI C, just a common extension. This caused problems on - at least Open Watcom C. - -Yang Tse (20 Jun 2008) -- Modified configuration script to actually verify if the compiler is good - enough at detecting compilation errors or at least it has been properly - configured to do so. Configuration heavily depends on this capability, so - if this compiler sanity check fails the configuration process will now fail. - -Daniel Stenberg (20 Jun 2008) -- Phil Pellouchoud found a case where libcurl built with NSS failed to - handshake with a SSLv2 server, and it turned out to be because it didn't - recognize the cipher named "rc4-md5". In our list that cipher was named - plainly "rc4". I've now added rc4-md5 to work as an alias as Phil reported - that it made things work for him again. - -- Hans-Jurgen May pointed out that trying SCP or SFTP over a SOCKS proxy - crashed libcurl. This is now addressed by making sure we use "plain send" - internally when doing the socks handshake instead of the Curl_write() - function which is designed to use the "target" protocol. That's then SCP or - SFTP in this case. I also took the opportunity and cleaned up some ssh- - related #ifdefs in the code for readability. - -Daniel Stenberg (19 Jun 2008) -- Christopher Palow fixed a curl_multi_socket() issue which previously caused - libcurl to not tell the app properly when a socket was closed (when the name - resolve done by c-ares is completed) and then immediately re-created and put - to use again (for the actual connection). Since the closure will make the - "watch status" get lost in several event-based systems libcurl will need to - tell the app about this close/re-create case. - -- Dengminwen found a bug in the connection re-use function when using the - multi interface with pipelining enabled as it would wrongly check for, - detect and close "dead connections" even though that connection was already - in use! - -Daniel Fandrich (18 Jun 2008) -- Added SSH failure test cases 628-632 - -- Fixed a memory leak in the command-line tool that caused a valgrind error. - -Daniel Stenberg (18 Jun 2008) -- Rob Crittenden brought a fix for the NSS layer that makes libcurl no longer - always fire up a new connection rather than using the existing one when the - multi interface is used. Original bug report: - https://bugzilla.redhat.com/show_bug.cgi?id=450140 - -Yang Tse (18 Jun 2008) -- Internal configure script improvement. No longer break out of shell "for" - statements from inside AC_FOO_IFELSE macros, otherwise temporary macro files - are not properly removed. - -Daniel Fandrich (12 Jun 2008) -- Fixed curl-config --ca which wasn't being exported by configure. - -Daniel Stenberg (11 Jun 2008) -- I did a cleanup of the internal generic SSL layer and how the various SSL - libraries are supported. Starting now, each underlying SSL library support - code does a set of defines for the 16 functions the generic layer (sslgen.c) - uses (all these new function defines use the prefix "curlssl_"). This - greatly simplified the generic layer in readability by involving much less - #ifdefs and other preprocessor stuff and should make it easier for people to - make libcurl work with new SSL libraries. - - Hopefully I can later on document these 16 functions somewhat as well. - - I also made most of the internal SSL-dependent functions (using Curl_ssl_ - prefix) #defined to nothing when no SSL support is requested - previously - they would unnecessarily call mostly empty functions. - - I've built libcurl with OpenSSL and GnuTLS and without SSL to test this and - I've also tried building with NSS but the NSS support is a mystery to me and - I failed to build libcurl with the NSS libraries I have installed. We really - should A) improve our configure script to detect unsuitable NSS versions - already at configure time and B) document our requirements better for the - SSL libraries. - -Daniel Stenberg (10 Jun 2008) -- I made the OpenSSL code build again with OpenSSL 0.9.6. The CRLFILE - functionality killed it due to its unconditional use of - X509_STORE_set_flags... - -Daniel Stenberg (8 Jun 2008) -- Due to the three new libcurl changes and the massive command line option - change I decided we'll mark it by bumping the next release number to 7.19.0! - -- curl the tool now deals with its command line options somewhat differently! - All boolean options (such as -O, -I, -v etc), both short and long versions, - now always switch on/enable the option named. Using the same option multiple - times thus make no difference. To switch off one of those options, you need - to use the long version of the option and type --no-OPTION. Like to disable - verbose mode you use --no-verbose! - -- Added --remote-name-all to curl, which if used changes the default for all - given URLs to be dealt with as if -O is used. So if you want to disable that - for a specific URL after --remote-name-all has been used, you muse use -o - - or --no-remote-name. - -Daniel Stenberg (6 Jun 2008) -- Axel Tillequin and Arnaud Ebalard added support for CURLOPT_ISSUERCERT, for - OpenSSL, NSS and GnuTLS-built libcurls. - -- Axel Tillequin and Arnaud Ebalard added support for CURLOPT_CRLFILE, for - OpenSSL, NSS and GnuTLS-built libcurls. - -- Added CURLINFO_PRIMARY_IP as a new information retrievable with - curl_easy_getinfo. It returns a pointer to a string with the most recently - used IP address. Modified test case 500 to also verify this feature. The - implementing of this feature was sponsored by Lenny Rachitsky at NeuStar. - -Version 7.18.2 (4 June 2008) - -Daniel Fandrich (3 Jun 2008) -- Fixed a problem where telnet data would be lost if an EWOULDBLOCK - condition were encountered. - -Marty Kuhrt (1 Jun 2008) -- Updated main.c to return CURLE_OK if PARAM_HELP_REQUESTED was returned - from getparameter instead of CURLE_FAILED_INIT. No point in returning - an error if --help or --version were requested. - -Daniel Stenberg (28 May 2008) -- Emil Romanus found a problem and helped me repeat it. It occured when using - the curl_multi_socket() API with HTTP pipelining enabled and could lead to - the pipeline basically stalling for a very long period of time until it took - off again. - -- Jeff Weber reported memory leaks with aborted SCP and SFTP transfers and - provided excellent repeat recipes. I fixed the cases I managed to reproduce - but Jeff still got some (SCP) problems even after these fixes: - https://curl.haxx.se/mail/lib-2008-05/0342.html - -Daniel Stenberg (26 May 2008) -- Bug report #1973352 (https://curl.haxx.se/bug/view.cgi?id=1973352) identified - how the HTTP redirect following code didn't properly follow to a new URL if - the new url was but a query string such as "Location: ?moo=foo". Test case - 1031 was added to verify this fix. - -- Andreas Faerber and Scott McCreary made (lib)curl build for the Haiku OS. - -Yang Tse (26 May 2008) -- David Rosenstrauch reported that header files spnegohelp.h and - openssl/objects.h were needed to compile SPNEGO support. - -Daniel Fandrich (22 May 2008) -- Made sure to pass longs in to curl_easy_setopt where necessary in the - example programs and libtest code. - -Daniel Stenberg (19 May 2008) -- When trying to repeat a multi interface problem I fell over a few multi - interface problems: - - o with pipelining disabled, the state should never be set to WAITDO but - rather go straight to DO - - o we had multiple states for which the internal function returned no socket - at all to wait for, with the effect that libcurl calls the socket callback - (when curl_multi_socket() is used) with REMOVE prematurely (as it would be - added again within very shortly) - - o when in DO and DOING states, the HTTP and HTTPS protocol handler functions - didn't return that the socket should be waited for writing, but instead it - was treated as if no socket was needing monitoring so again REMOVE was - called prematurely. - -Daniel Stenberg (13 May 2008) -- Added test case 556 that uses curl_easy_send() and curl_easy_recv() - -Daniel Stenberg (9 May 2008) -- Introducing curl_easy_send() and curl_easy_recv(). They can be used to send - and receive data over a connection previously setup with curl_easy_perform() - and its CURLOPT_CONNECT_ONLY option. The sendrecv.c example was added to - show how they can be used. - -Yang Tse (9 May 2008) -- Internal time differences now use monotonic time source if available. - This also implies the removal of the winmm.lib dependency for WIN32. - -Daniel Stenberg (9 May 2008) -- Stefan Krause reported a busy-looping case when using the multi interface - and doing CONNECT to a proxy. The app would then busy-loop until the proxy - completed its response. - -Michal Marek (9 May 2008) -- Make Curl_write and it's callees accept a const pointer, in preparation - of tetetest's patch for curl_easy_send() - -Daniel Stenberg (7 May 2008) -- Liam Healy filed the debian bug report #480044 - (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480044) identifying a - segfault when using krb5 ftp, but the krb4 code had the same problem. - -Yang Tse (7 May 2008) -- Christopher Palow provided the patch (edited by me) that introduces the - use of microsecond resolution keys for internal splay trees. - -Daniel Stenberg (4 May 2008) -- Yuriy Sosov pointed out a configure fix for detecting c-ares when that is - built debug-enabled. - -Daniel Stenberg (3 May 2008) -- Ben Van Hof filed bug report #1945240: "libcurl sometimes sends body twice - when using CURL_AUTH_ANY" (https://curl.haxx.se/bug/view.cgi?id=1945240). - The problem was that when libcurl rewound a stream meant for upload when it - would prepare for a second request, it could accidentally continue the - sending of the rewound data on the first request instead of on the second. - Ben also provided test case 1030 that verifies this fix. - -Daniel Stenberg (3 May 2008) -- Jean-Francois Bertrand reported a libcurl crash with CURLOPT_TCP_NODELAY - since libcurl used getprotobyname() and that isn't thread-safe. We now - switched to use IPPROTO_TCP unconditionally, but perhaps the proper fix is - to detect the thread-safe version of the function and use that. - https://curl.haxx.se/mail/lib-2008-05/0011.html - -Daniel Stenberg (1 May 2008) -- Bart Whiteley provided a patch that made libcurl work properly when an app - uses the CURLOPT_OPENSOCKETFUNCTION callback to create a unix domain socket - to a http server. - -Daniel Stenberg (29 Apr 2008) -- To make it easier for applications that want lots of magic stuff done on - redirections and thus cannot use CURLOPT_FOLLOWLOCATION easily, we now - introduce the new CURLINFO_REDIRECT_URL option that lets applications - extract the URL libcurl would've redirected to if it had been told to. This - then enables the application to continue to that URL as it thinks is - suitable, without having to re-implement the magic of creating the new URL - from the Location: header etc. Test 1029 verifies it. - -Yang Tse (29 Apr 2008) -- Improved easy interface resolving timeout handling in c-ares enabled builds - -Daniel Fandrich (28 Apr 2008) -- Added test 1028 to test an HTTP redirect to a FTP URL. - -Daniel Stenberg (28 Apr 2008) -- Norbert Frese filed bug report #1951588: "Problem with curlftpfs and - libcurl" (https://curl.haxx.se/bug/view.cgi?id=1951588) which seems to be an - identical report to what Denis Golovan reported in - https://curl.haxx.se/mail/lib-2008-02/0108.html The FTP code didn't reset the - user/password pointers properly even though there might've been a new - struct/cconnection getting used. - -Daniel Stenberg (26 Apr 2008) -- Reverted back to use automake 1.9.6 in the next release (from automake - 1.10.1) since it *still* suffers from Solaris-related bugs. Our previous - automake 1.10 problem was reported in bug #1701360 - (https://curl.haxx.se/bug/view.cgi?id=1701360) and this recent problem was - bug #1944825 (https://curl.haxx.se/bug/view.cgi?id=1944825). I have not - personally approached the automake team about either one of these but I - figure we need a Solaris 10 guy to do it! - -Yang Tse (25 Apr 2008) -- Added 'timeout' and 'delay' attributes support for the test harness - <command> subsection. - -Daniel Fandrich (24 Apr 2008) -- Made --stderr able to redirect all stderr messages. - -Yang Tse (23 Apr 2008) -- Improve synchronization between test harness runtests.pl script - and test harness servers to minimize risk of false test failures. - -Daniel Fandrich (22 Apr 2008) -- Added support for running on Symbian OS. - -Daniel Fandrich (18 Apr 2008) -- Added test cases 1026 and 1027 to do some rudimentary tests on the --manual - and --help options. - -Michal Marek (14 Apr 2008) -- allow disabling the typechecker by defining CURL_DISABLE_TYPECHECK, as - discussed in https://curl.haxx.se/mail/lib-2008-04/0291.html - -Daniel Stenberg (14 Apr 2008) -- Stefan Krause reported a case where the OpenSSL handshake phase wasn't - properly acknowledging the timeout values, like if you pulled the network - plug in the midst of it. - -- Andre Guibert de Bruet fixed a second case of not checking the malloc() - return code in the Negotiate code. - -- Sandor Feldi reported bug #1942022 - (https://curl.haxx.se/bug/view.cgi?id=1942022) pointing out a mistake in the - lib/Makefile.vc[68] makefiles' release-ssl-dll target. - -- Brock Noland reported that curl behaved differently depending on which order - you used -i and -I. - -Daniel Stenberg (12 Apr 2008) -- Andre Guibert de Bruet found and fixed a case where malloc() was called but - was not checked for a NULL return, in the Negotiate code. - -Daniel Fandrich (9 Apr 2008) -- Added test cases 1024 & 1025 to test a scenario similar to the one reported - by Ben Combee where libcurl would send the wrong cookie to a redirected - server. libcurl was doing the right thing in these test cases. - -Michal Marek (7 Apr 2008) -- Fix the MIT / Heimdal check for good: - Define HAVE_GSSMIT if <gssapi/{gssapi.h,gssapi_generic.h,gssapi_krb5.h}> are - available, otherwise define HAVE_GSSHEIMDAL if <gssapi.h> is available. - - Only define GSS_C_NT_HOSTBASED_SERVICE to gss_nt_service_name if - GSS_C_NT_HOSTBASED_SERVICE isn't declared by the gssapi headers. This should - avoid breakage in case we wrongly recognize Heimdal as MIT again. - -Daniel Stenberg (5 Apr 2008) -- Alexey Simak fixed curl_easy_reset() to reset the max redirect limit properly - -- Based on the Debian bug report #474224 that complained about the FTP error - message when libcurl doesn't get a 220 back immediately on connect, I now - changed it to be more specific on what the problem is. Also worth noticing: - while the bug report contains an example where the response is: - - 421 There are too many connected users, please try again later - - we cannot assume that the error message will always be this readable nor - that it fits within a particular boundary etc. - -Daniel Fandrich (3 Apr 2008) -- Added test627 to test SFTP with CURLOPT_NOBODY - -Daniel Stenberg (3 Apr 2008) -- Setting CURLOPT_NOBODY to FALSE will now switch the HTTP request method to - GET simply because previously when you set CURLOPT_NOBODY to TRUE first and - then FALSE you'd end up in a broken state where a HTTP request would do a - HEAD by still act a lot like for a GET and hang waiting for the content etc. - -- Scott Barrett added support for CURLOPT_NOBODY over SFTP - -Daniel Fandrich (3 Apr 2008) -- Made sure that curl_global_init is called in all the multithreaded - example programs. - -Michal Marek (31 Mar 2008) -- Removed the generated ca-bundle.h file. The verbatim value of $ca and - $capath is known to configure, so it can be defined in config.h instead. - -Daniel Stenberg (31 Mar 2008) -- Added CURLFORM_STREAM as a supported option to curl_formadd() to allow an - application to provide data for a multipart with the read callback. Note - that the size needs to be provided with CURLFORM_CONTENTSLENGTH when the - stream option is used. This feature is verified by the new test case - 554. This feature was sponsored by Xponaut. - -Daniel Fandrich (30 Mar 2008) -- Changed the makefile so the doc/examples/ programs are never built in a - normal build/install (only with the 'make check' target), so that a - build failure in the examples isn't fatal. - -Version 7.18.1 (30 March 2008) - -Daniel Stenberg (28 Mar 2008) -- Stephen Collyer pointed out that configure --with-libssh2 without a given - path didn't work properly. - -Daniel Stenberg (27 Mar 2008) -- As found out and reported by Dan Petitt, libcurl didn't show progress/call - the progress callback for the first (potentially huge) piece of body data - sent together with the POST request headers in the initial send(). - -Daniel Stenberg (25 Mar 2008) -- Made setting the CURLOPT_SSL_CTX_FUNCTION option return a failure in case - libcurl wasn't built to use OpenSSL as that is a prerequisite for this - option to function! - -Daniel Stenberg (22 Mar 2008) -- Fixed the problem with doing a zero byte SCP transfer, verified with test - case 617 (which was added by Daniel Fandrich 5 Mar 2008). - -Daniel Fandrich (20 Mar 2008) -- Fixed a problem where curl-config --protocols could erroneously show LDAPS - support when curl didn't even have regular LDAP support. It looks like - this could happen when the --enable-ldaps configure switch is given but - configure couldn't find the LDAP headers or libraries. - -Michal Marek (20 Mar 2008) -- Added --with-ca-path=DIRECTORY configure option to use an openSSL CApath by - default instead of a ca bundle. The configure script will also look for a - ca path if no ca bundle is found and no option given. - -- Fixed detection of previously installed curl-ca-bundle.crt - -Daniel Fandrich (18 Mar 2008) -- Added test 626 to reproduce an infinite loop when given an invalid - SFTP quote command reported by Vincent Le Normand, and fixed it. - -Michal Marek (18 Mar 2008) -- Added curl_easy_getinfo typechecker. - -- Added macros for curl_share_setopt and curl_multi_setopt to check at least - the correct number of arguments. - -Daniel Fandrich (13 Mar 2008) -- Added tests 622-625 to test SFTP/SCP uploads. Test 625 was an attempt to - reproduce the --ftp-create-dirs problem reported by Brian Ulm, but that - seems to need a call curl_easy_reset() which this test case doesn't do. - -Daniel Stenberg (13 Mar 2008) -- Brian Ulm figured out that if you did an SFTP upload with - CURLOPT_FTP_CREATE_MISSING_DIRS to create a directory, and then re-used the - handle and uploaded another file to another directory that needed to be - created, the second upload would fail. Another case of a state variable that - wasn't properly reset between requests. - -- I rewrote the 100-continue code to use a single state variable instead of - the previous two ones. I think it made the logic somewhat clearer. - -Daniel Stenberg (11 Mar 2008) -- Dmitry Popov filed bug report #1911069 - (https://curl.haxx.se/bug/view.cgi?id=1911069) that identified a race - condition in the name resolver code when the DNS cache is shared between - multiple easy handles, each running in simultaneous threads that could cause - crashes. - -- Added a macro for curl_easy_setopt() that accepts three arguments and simply - does nothing with them, just to make sure libcurl users always use three - arguments to this function. Due to its use of ... for the third argument, it - is otherwise hard to detect abuse. - -Michal Marek (11 Mar 2008) -- Added a type checking macro for curl_easy_setopt(), needs gcc-4.3 and only - works in C mode atm (https://curl.haxx.se/mail/lib-2008-02/0267.html , - https://curl.haxx.se/mail/lib-2008-02/0292.html ) - -Daniel Fandrich (10 Mar 2008) -- Added tests 618-621 to test SFTP/SCP transfers of more than one file - (test 620 tests the just-fixed problem reported by Brian Ulm). - -Daniel Stenberg (9 Mar 2008) -- Brian Ulm reported a crash when doing a second SFTP transfer on a re-used - easy handle if curl_easy_reset() was used between them. I fixed it and Brian - verified that it cured his problem. - -- Brian Ulm reported that if you first tried to download a non-existing SFTP - file and then fetched an existing one and re-used the handle, libcurl would - still report the second one as non-existing as well! I fixed it and Brian - verified that it cured his problem. - -Michal Marek (6 Mar 2008) -- Fix the gssapi configure check to detect newer MIT Kerberos (patch by - Michael Calmer) - -Yang Tse (6 Mar 2008) -- Fix regression on Curl_socket_ready() and Curl_poll() so that these will - again fail on select/poll errors different than EINTR. - -Daniel Fandrich (5 Mar 2008) -- Fixed the test harness so it will write out zero-length data files. - -- Added tests 616 and 617 to see how SFTP and SCP cope with zero-length - files, as questioned by Mike Protts. SFTP does for me but SCP doesn't - so test 617 is disabled for now. - -Daniel S (4 Mar 2008) -- Mike Protts brought a patch that makes resumed transfers work with SFTP. - -Daniel S (1 Mar 2008) -- Anatoli Tubman found and fixed a crash with Negotiate authentication used on - a re-used connection where both requests used Negotiate. - -Guenter Knauf (26 Feb 2008) -- Kaspar Brand provided a patch to support server name indication (RFC 4366). - -Daniel S (25 Feb 2008) -- Kaspar Brand made GnuTLS-built libcurl properly acknowledge the option that - forces it to prefer SSLv3. - -Daniel S (23 Feb 2008) -- Sam Listopad provided a patch in feature-request #1900014 - https://curl.haxx.se/bug/feature.cgi?id=1900014 that makes libcurl (built to - use OpenSSL) support a full chain of certificates in a given PKCS12 - certificate. - -Daniel S (22 Feb 2008) -- Georg Lippitsch made the src/Makefile.vc6 makefile use the same memory model - options as the lib/Makefile.vc6 already did. - -Daniel S (21 Feb 2008) -- Zmey Petroff found a crash when libcurl accessed a NULL pointer, which - happened if you set the connection cache size to 1 and for example failed to - login to an FTP site. Bug report #1896698 - (https://curl.haxx.se/bug/view.cgi?id=1896698) - -Daniel S (20 Feb 2008) -- Fixed test case 405 to not fail when libcurl is built with GnuTLS - -- Based on initial work done by Gautam Kachroo to address a bug, we now keep - better control at the exact state of the connection's SSL status so that we - know exactly when it has completed the SSL negotiation or not so that there - won't be accidental re-uses of connections that are wrongly believed to be - in SSL-completed-negotiate state. - -- We no longer support setting the CURLOPT_URL option from inside a callback - such as the CURLOPT_SSL_CTX_FUNCTION one treat that as if it was a Location: - following. The patch that introduced this feature was done for 7.11.0, but - this code and functionality has been broken since about 7.15.4 (March 2006) - with the introduction of non-blocking OpenSSL "connects". - - It was a hack to begin with and since it doesn't work and hasn't worked - correctly for a long time and nobody has even noticed, I consider it a very - suitable subject for plain removal. And so it was done. - -Guenter Knauf (19 Feb 2008) -- We do no longer support SSLv2 by default since it has known flaws. - Kaspar Brand provided a patch for all supported SSL toolkits. - -Daniel Fandrich (19 Feb 2008) -- Added test309 to test HTTP redirect to HTTPS URL - -Daniel S (18 Feb 2008) -- We're no longer providing a very old ca-bundle in the curl tarball. You can - get a fresh one downloaded and created with 'make ca-bundle' or you can get - one from here => https://curl.haxx.se/docs/caextract.html if you want a fresh - new one extracted from Mozilla's recent list of ca certs. - - The configure option --with-ca-bundle now lets you specify what file to use - as default ca bundle for your build. If not specified, the configure script - will check a few known standard places for a global ca cert to use. - -Daniel S (17 Feb 2008) -- Jerome Muffat-Meridol helped me fix Curl_done() to close the current - connection by force when it was called before the entire request is - completed, simply because we can't know if the connection really can be - re-used safely at that point. - -- Based on the same debugging logic, I've also made Curl_http_done() not - return CURLE_GOT_NOTHING if called "prematurely". This should have no real - effect to anything but the code makes more sense like this. - -Daniel S (15 Feb 2008) -- Made the gnutls code path not even try to get the server cert if no peer - verification is requested. Previously it would even return failure if gnutls - failed to get the server cert even though no verification was asked for. - Public server showing the problem: https://www.net222.caisse-epargne.fr - -- Fix my Curl_timeleft() leftover mistake in the gnutls code - -- Pooyan McSporran found and fixed a flaw where you first would do a normal - http request and then you'd reuse the handle and replace the Accept: header, - as then libcurl would send two Accept: headers! - -Daniel S (11 Feb 2008) -- Yang Tse pointed out a few remaining quirks from my timeout refactoring from - Feb 7 that didn't abort properly on timeouts. These are actually old - problems but now they should be fixed. - -Yang Tse (10 Feb 2008) -- Bug report #1888932 (https://curl.haxx.se/bug/view.cgi?id=1888932) points out - and provides test program that demonstrates that libcurl might not set error - description message for error CURLE_COULDNT_RESOLVE_HOST for Windows threaded - name resolver builds. Fixed now. - -Daniel Fandrich (8 Feb 2008) -- Added key words to all SSL-using tests so they can be skipped if necessary. - Removed a few unnecessary requires SSL statements. - -Daniel S (8 Feb 2008) -- Mike Hommey filed and fixed bug report #1889856 - (https://curl.haxx.se/bug/view.cgi?id=1889856): When using the gnutls ssl - layer, cleaning-up and reinitializing curl ends up with https requests - failing with "ASN1 parser: Element was not found" errors. Obviously a - regression added in 7.16.3. - -Yang Tse (8 Feb 2008) -- Improved test harness SCP/SFTP start up server verification, doing a real - connection to the sftp server, authenticating and running a simple sftp - pwd command using the test harness generated configuration and key files. - -Daniel S (8 Feb 2008) -- Günter Knauf added lib/mk-ca-bundle.pl which gets the Firefox ca bundle and - creates a suitable ca-bundle.crt file in PEM format for use with curl. The - recommended way to run it is to use 'make ca-bundle' in the build tree root. - -Daniel Fandrich (7 Feb 2008) -- Added tests 1022 and 1023 to validate output of curl-config --version and - --vernum - -Daniel S (7 Feb 2008) -- Refactored a lot of timeout code into a few functions in an attempt to make - them all use the same (hopefully correct) logic to make it less error-prone - and easier to introduce library-wide where it should be used. - -Yang Tse (6 Feb 2008) -- Fix an issue in strdup replacement function when dealing with absolutely - huge strings. Only systems without a standard strdup would be affected. - -Daniel S (3 Feb 2008) -- Dmitry Kurochkin cleaned up the pipelining code and removed the need for and - use of the "is_in_pipeline" struct field. - -- I wrote up and added the threaded-ssl.c example source code that shows how - to do multi-threaded downloads of HTTPS files with a libcurl that is built - with OpenSSL. It uses pthreads for the threading. - -Daniel S (31 Jan 2008) -- Niklas Angebrand made the cookie support in libcurl properly deal with the - "HttpOnly" feature introduced by Microsoft and apparently also supported by - Firefox: https://msdn.microsoft.com/en-us/library/ms533046.aspx . HttpOnly - is now supported when received from servers in HTTP headers, when written to - cookie jars and when read from existing cookie jars. - - I modified test case 31 and 46 to also do some basic HttpOnly testing. - -- Dmitry Kurochkin moved several struct fields from the connectdata struct to - the SingleRequest one to make pipelining better. It is a bit tricky to keep - them in the right place, to keep things related to the actual request or to - the actual connection in the right place. - -Daniel S (29 Jan 2008) -- Dmitry Kurochkin fixed Curl_done() for pipelining, as it could previously - crash! - -- Michal Marek fixed minor mistake in test case 553 that prevented it from - working on other IP-addresses or port numbers. - -Version 7.18.0 (28 January 2008) - -Daniel S (27 Jan 2008) -- Dmitry Kurochkin: In "real world" testing I found more bugs in - pipelining. Broken connection is not restored and we get into infinite - loop. It happens because of wrong is_in_pipeline values. - -Daniel S (26 Jan 2008) -- Kevin Reed filed bug report #1879375 - (https://curl.haxx.se/bug/view.cgi?id=1879375) which describes how libcurl - got lost in this scenario: proxy tunnel (or HTTPS over proxy), ask to do any - proxy authentication and the proxy replies with an auth (like NTLM) and then - closes the connection after that initial informational response. - - libcurl would not properly re-initialize the connection to the proxy and - continue the auth negotiation like supposed. It does now however, as it will - now detect if one or more authentication methods were available and asked - for, and will thus retry the connection and continue from there. - -- I made the progress callback get called properly during proxy CONNECT. - -Daniel S (23 Jan 2008) -- Igor Franchuk pointed out that CURLOPT_COOKIELIST set to "ALL" leaked - memory, and so did "SESS". Fixed now. - -Yang Tse (22 Jan 2008) -- Check poll.h at configuration time, and use it when sys/poll.h unavailable - -Daniel S (22 Jan 2008) -- Dmitry Kurochkin removed the cancelled state for pipelining, as we agreed - that it is bad anyway. Starting now, removing a handle that is in used in a - pipeline will break the pipeline - it'll be set back up again but still... - -Yang Tse (21 Jan 2008) -- Disable ldap support for cygwin builds, since it breaks whole build process. - Fixing it will affect other platforms, so it is postponed for another release. - -Daniel S (18 Jan 2008) -- Lau Hang Kin found and fixed a problem with the multi interface when doing - CONNECT over a proxy. curl_multi_fdset() didn't report back the socket - properly during that state, due to a missing case in the switch in the - multi_getsock() function. - -Yang Tse (17 Jan 2008) -- Don't abort tests 518 and 537 when unable to raise the open-file soft limit. - -Daniel S (16 Jan 2008) -- Nathan Coulter's patch that makes runtests.pl respect the PATH when figuring - out what valgrind to run. - -Yang Tse (16 Jan 2008) -- Improved handling of out of memory in the command line tool that afected - data url encoded HTTP POSTs when reading it from a file. - -Daniel S (16 Jan 2008) -- Dmitry Kurochkin worked a lot on improving the HTTP Pipelining support that - previously had a number of flaws, perhaps most notably when an application - fired up N transfers at once as then they wouldn't pipeline at all that - nicely as anyone would think... Test case 530 was also updated to take the - improved functionality into account. - -- Calls to Curl_failf() are not supposed to provide a trailing newline as the - function itself adds that. Fixed on 50 or something strings! - -Daniel S (15 Jan 2008) -- I made the torture test on test 530 go through. This was actually due to - silly code left from when we switched to let the multi handle "hold" the dns - cache when using the multi interface... Of course this only triggered when a - certain function call returned error at the correct moment. - -Daniel S (14 Jan 2008) -- Joe Malicki filed bug report #1871269 - (https://curl.haxx.se/bug/view.cgi?id=1871269) and we could fix his hang- - problem that occurred when doing a large HTTP POST request with the - response-body read from a callback. - -Daniel S (12 Jan 2008) -- I re-arranged the curl --help output. All the options are now sorted on - their long option names and all descriptions are one-liners. - -- Eric Landes provided the patch (edited by me) that introduces the - --keepalive-time to curl to set the keepalive probe interval. I also took - the opportunity to rename the recently added no-keep-alive option to - no-keepalive to keep a consistent naming and to avoid getting two dashes in - these option names. Eric also provided an update to the man page for the new - option. - -Daniel S (11 Jan 2008) -- Daniel Egger made CURLOPT_RANGE work on file:// URLs the very same way it - already worked for FTP:// URLs. - -- I made the curl tool switch from using CURLOPT_IOCTLFUNCTION to now use the - spanking new CURLOPT_SEEKFUNCTION simply to take advantage of the improved - performance for the upload resume cases where you want to upload the last - few bytes of a very large file. To implement this decently, I had to switch - the client code for uploading from fopen()/fread() to plain open()/read() so - that we can use lseek() to do >32bit seeks (as fseek() doesn't allow that) - on systems that offer support for that. - -Daniel S (10 Jan 2008) -- Michal Marek made curl-config --libs not include /usr/lib64 in the output - (it already before skipped /usr/lib). /usr/lib64 is the default library - directory on many 64bit systems and it's unlikely that anyone would use the - path privately on systems where it's not. - -- Georg Lippitsch brought CURLOPT_SEEKFUNCTION and CURLOPT_SEEKDATA to allow - libcurl to seek in a given input stream. This is particularly important when - doing upload resumes when there's already a huge part of the file present - remotely. Before, and still if this callback isn't used, libcurl will read - and through away the entire file up to the point to where the resuming - begins (which of course can be a slow opereration depending on file size, - I/O bandwidth and more). This new function will also be preferred to get - used instead of the CURLOPT_IOCTLFUNCTION for seeking back in a stream when - doing multi-stage HTTP auth with POST/PUT. - -- Nikitinskit Dmitriy filed bug report #1868255 - (https://curl.haxx.se/bug/view.cgi?id=1868255) with a patch. It identifies - and fixes a problem with parsing WWW-Authenticate: headers with additional - spaces in the line that the parser wasn't written to deal with. - -Daniel S (8 Jan 2008) -- Introducing curl_easy_pause() and new magic return codes for both the read - and the write callbacks that now can make a connection's reading and/or - writing get paused. - -Daniel S (6 Jan 2008) -- Jeff Johnson filed bug report #1863171 - (https://curl.haxx.se/bug/view.cgi?id=1863171) where he pointed out that - libcurl's date parser didn't accept a +1300 time zone which actually is used - fairly often (like New Zealand's Dailight Savings Time), so I modified the - parser to now accept up to and including -1400 to +1400. - -Daniel S (5 Jan 2008) -- Based on further discussion on curl-library, I reverted yesterday's SOCKS5 - code to instead introduce support for a new proxy type called - CURLPROXY_SOCKS5_HOSTNAME that is used to send the host name to the proxy - instead of IP address and there's thus no longer any need for a new - curl_easy_setopt() option. - - The default SOCKS5 proxy is again back to sending the IP address to the - proxy. The new curl command line option for enabling sending host name to a - SOCKS5 proxy is now --socks5-hostname. - -Daniel S (4 Jan 2008) -- Based on Maxim Perenesenko's patch, we now do SOCKS5 operations and let the - proxy do the host name resolving and only if --socks5ip (or - CURLOPT_SOCKS5_RESOLVE_LOCAL) is used we resolve the host name locally and - pass on the IP address only to the proxy. - -Yang Tse (3 Jan 2008) -- Modified test harness to allow SCP, SFTP and SOCKS4 tests to run with - OpenSSH 2.9.9, SunSSH 1.0 or later versions. SOCKS5 tests need OpenSSH - 3.7, SunSSH 1.0 or later. - -Daniel S (2 Jan 2008) -- I fixed two cases of missing return code checks when handling chunked - decoding where a write error (or abort return from a callback) didn't stop - libcurl's processing. - -- I removed the socklen_t use from the public curl/curl.h header and instead - made it an unsigned int. The type was only used in the curl_sockaddr struct - definition (only used by the curl_opensocket_callback). On all platforms I - could find information about, socklen_t is 32 unsigned bits large so I don't - think this will break the API or ABI. The main reason for this change is of - course for all the platforms that don't have a socklen_t definition in their - headers to build fine again. Providing our own configure magic and custom - definition of socklen_t on those systems proved to work but was a lot of - cruft, code and extra magic needed - when this very small change of type - seems harmless and still solves the missing socklen_t problem. - -- Richard Atterer brought a patch that added support for SOCKS4a proxies, - which is an inofficial PROXY4 variant that sends the hostname to the proxy - instead of the resolved address (which is already supported by SOCKS5). - --socks4a is the curl command line option for it and CURLOPT_PROXYTYPE can - now be set to CURLPROXY_SOCKS4A as well. - -Daniel S (1 Jan 2008) -- Mohun Biswas pointed out that --libcurl generated a source code with an int - function but without a return statement. While fixing that, I also took care - about adding some better comments for the generated code. - -Daniel S (27 Dec 2007) -- Dmitry Kurochkin mentioned a flaw - (https://curl.haxx.se/mail/lib-2007-12/0252.html) in detect_proxy() which - failed to set the bits.proxy variable properly when an environment variable - told libcurl to use a http proxy. - -Daniel S (26 Dec 2007) -- In an attempt to repeat the problem in bug report #1850730 - (https://curl.haxx.se/bug/view.cgi?id=1850730) I wrote up test case 552. The - test is doing a 70K POST with a read callback and an ioctl callback over a - proxy requiring Digest auth. The test case code is more or less identical to - the test recipe code provided by Spacen Jasset (who submitted the bug - report). - -Daniel S (25 Dec 2007) -- Gary Maxwell filed bug report #1856628 - (https://curl.haxx.se/bug/view.cgi?id=1856628) and provided a fix for the - (small) memory leak in the SSL session ID caching code. It happened when a - previous entry in the cache was re-used. - -Daniel Fandrich (19 Dec 2007) -- Ensure that nroff doesn't put anything but ASCII characters into the - --manual text. - -Yang Tse (18 Dec 2007) -- MSVC 9.0 (VS2008) does not support Windows build targets prior to WinXP, - and makes wrong asumptions of build target when it isn't specified. So, - if no build target has been defined we will target WinXP when building - curl/libcurl with MSVC 9.0 (VS2008). - -- (https://curl.haxx.se/mail/archive-2007-12/0039.html) reported and fixed - a file truncation problem on Windows build targets triggered when retrying - a download with curl. - -Daniel S (17 Dec 2007) -- Mateusz Loskot pointed out that MSVC 9.0 (VS2008) has the pollfd struct and - defines in winsock2.h somehow differently than previous versions and that - curl 7.17.1 would fail to compile out of the box. - -Daniel S (13 Dec 2007) -- David Wright filed bug report #1849764 - (https://curl.haxx.se/bug/view.cgi?id=1849764) with an included fix. He - identified a problem for re-used connections that previously had sent - Expect: 100-continue and in some situations the subsequent POST (that didn't - use Expect:) still had the internal flag set for its use. David's fix (that - makes the setting of the flag in every single request unconditionally) is - fine and is now used! - -Daniel S (12 Dec 2007) -- Gilles Blanc made the curl tool enable SO_KEEPALIVE for the connections and - added the --no-keep-alive option that can disable that on demand. - -Daniel S (9 Dec 2007) -- Andrew Moise filed bug report #1847501 - (https://curl.haxx.se/bug/view.cgi?id=1847501) and pointed out a memcpy() - that should be memmove() in the convert_lineends() function. - -Daniel S (8 Dec 2007) -- Renamed all internal static functions that had Curl_ prefixes to no longer - have them. The Curl_ prefix is exclusively used for library internal global - symbols. Static functions can be named anything, except for using Curl_ or - curl_ prefixes. This is for consistency and for easier maintainance and - overview. - -- Cleaned up and reformatted the TODO document to look like the FAQ and - CONTRIBUTE, which makes nicer web pages - -- Added test cases 549 and 550 that test CURLOPT_PROXY_TRANSFER_MODE. - -- Added keywords on a bunch of test cases - -- Fixed an OOM problem in the curl code that would lead to fclose on a bad - handle and crash - -Daniel S (5 Dec 2007) -- Spacen Jasset reported a problem with doing POST (with data read with a - callback) over a proxy when NTLM is used as auth with the proxy. The bug - also concerned Digest and was limited to using callback only. Spacen worked - with us to provide a useful patch. I added the test case 547 and 548 to - verify two variations of POST over proxy with NTLM. - -Daniel S (3 Dec 2007) -- Ray Pekowski filed bug report #1842029 - (https://curl.haxx.se/bug/view.cgi?id=1842029) in which he identified a - problem with SSL session caching that prevent it from working, and provided - the associated fix! - -- Now libcurl (built with OpenSSL) doesn't return error anymore if the remote - SSL-based server doesn't present a certificate when the request is told to - ignore certificate verification anyway. - -- Michal Marek introduced CURLOPT_PROXY_TRANSFER_MODE which is used to control - the appending of the "type=" thing on FTP URLs when they are passed to a - HTTP proxy. Some proxies just don't like that appending (which is done - unconditionally in 7.17.1), and some proxies treat binary/ascii transfers - better with the appending done! - -Daniel S (29 Nov 2007) -- A bug report on the curl-library list showed a HTTP Digest session going on - with a 700+ letter nonce. Previously libcurl only support 127 letter ones - and now I bumped it to 1023. - -- Fixed the resumed FTP upload loop to not require that the read callback - returns a full buffer on each invoke. - -Daniel S (25 Nov 2007) -- Added test case 1015 that tests --data-urlencode in multiple ways - -- Fixed --data-urlencode for when no @ or = are used - -- Extended the user-agent buffer curl uses, since we can hit the 128 byte - border with plenty development libraries used. Like my current set: "curl - 7.17.2-CVS (i686-pc-linux-gnu) libcurl/7.17.2-CVS OpenSSL/0.9.8g - zlib/1.2.3.3 c-ares/1.5.2-CVS libidn/1.1 libssh2/0.19.0-CVS" - -Daniel S (24 Nov 2007) -- Internal rearrangements, so that the previous struct HandleData is no more. - It is now known as SingleRequest and the Curl_transfer_keeper struct within - that was remove entirely. This has the upside that there are less duplicate - struct members that made it hard to see and remember what struct that was - used to store what data. The transfer_keeper thing was once stored on a - per-connection basis and then it made sense to have the duplicate info but - since it was moved to the SessionHandle (in 7.16.0) it just added weirdness. - The SingleRequest struct is used by data that only is valid for this single - request. - -Yang Tse (22 Nov 2007) -- Provide a socklen_t definition in curl.h for Win32 API build targets - which don't have one. - -Daniel S (22 Nov 2007) -- Alessandro Vesely helped me improve the --data-urlencode's syntax, parser - and documentation. - -Daniel S (21 Nov 2007) -- While inspecting the Negotiate code, I noticed how the proxy auth was using - the same state struct as the host auth, so both could never be used at the - same time! I fixed it (without being able to check) to use two separate - structs to allow authentication using Negotiate on host and proxy - simultaneously. - -Daniel S (20 Nov 2007) -- Emil Romanus pointed out a bug that made an easy handle get the cookie - engine activated when set to use a share (even if the share doesn't share - cookies). I fixed it. - -- Fixed a very long-lasting mprintf() bug that occurred when we did "%.*s%s", - since the second %s would then wrongly used the numerical precision argument - instead and crash. - -- Introduced --data-urlencode to the curl tool for easier url encoding of the - data sent in a post. - -Daniel S (18 Nov 2007) -- Rob Crittenden fixed SSL connections with NSS done with the multi-interface - -Daniel S (17 Nov 2007) -- Michal Marek made the test suite remember what test servers that fail to - start so that subsequent tries are simply skipped. - -- Andres Garcia made the examples build fine on Windows (mingw + msys) when - the lib was built staticly. - -Daniel S (16 Nov 2007) -- Ates Goral identified a problem in http.c:add_buffer_send() when a debug - callback was used, as it could wrongly pass on a bad size for the outgoing - HTTP header. The bad size would be a very large value as it was a wrapped - size_t content. This happened when the whole HTTP request failed to get sent - in one single send. https://curl.haxx.se/mail/lib-2007-11/0165.html - -Daniel S (15 Nov 2007) -- Fixed yet another remaining problem with doing SFTP directory listings on a - re-used persistent connection. Mentioned by Immanuel Gregoire on the mailing - list. - -- Michal Marek fixed the test suite to better deal with the case when the HTTP - IPv6 server can't run. - -Yang Tse (14 Nov 2007) -- Fix a variable potential wrapping in add_buffer() when using absolutely - huge send buffer sizes. - -Daniel S (13 Nov 2007) -- Fixed a remaining problem with doing SFTP directory listings on a re-used - persistent connection. Mentioned by Immanuel Gregoire on the mailing list. - -Daniel S (12 Nov 2007) -- Bug report #1830637 (https://curl.haxx.se/bug/view.cgi?id=1830637), which was - forwarded from the Gentoo bug tracker by Daniel Black and was originally - submitted by Robin Johnson, pointed out that libcurl would do bad memory - references when it failed and bailed out before the handler thing was - setup. My fix is not done like the provided patch does it, but instead I - make sure that there's never any chance for a NULL pointer in that struct - member. - -Yang Tse (10 Nov 2007) -- Vikram Saxena (https://curl.haxx.se/mail/lib-2007-11/0096.html) pointed out - that the pollfd struct was being multi defined when using VS2008. This is - now fixed in /curl/lib/select.h - -Daniel S (8 Nov 2007) -- Bug report #1823487 (https://curl.haxx.se/bug/view.cgi?id=1823487) pointed - out that SFTP requests didn't use persistent connections. Neither did SCP - ones. I gave the SSH code a good beating and now both SCP and SFTP should - use persistent connections fine. I also did a bunch of indent changes as - well as a bug fix for the "keyboard interactive" auth. - -Dan F (6 Nov 2007) -- Improved telnet support by drastically reducing the number of write - callbacks needed to pass a buffer to the user. Instead one per byte it - is now as little as one per segment. - -Yang Tse (6 Nov 2007) -- Bug report #1824894 (https://curl.haxx.se/bug/view.cgi?id=1824894) pointed - out a problem in curl.h when building C++ apps with MSVC. To fix it, the - inclusion of header files in curl.h is moved outside of the C++ extern "C" - linkage block. - -Daniel S (1 Nov 2007) -- Toby Peterson patched a memory problem in the command line tool that - happened when a user had a home dir as an empty string. curl would then do - free() on a wrong area. - -Dan F (1 Nov 2007) -- Fixed curl-config --features to not display libz when it wasn't used - due to a missing header file. - -Dan F (31 October 2007) -- Fixed the output of curl-config --protocols which showed SCP and SFTP - always, except when --without-libssh2 was given - -- Added test cases 1013 and 1014 to check that curl-config --protocols and - curl-config --features matches the output of curl --version - -Dan F (30 October 2007) -- Fixed an OOM problem with file: URLs - -- Moved Curl_file_connect into the protocol handler struct - -Dan F (29 October 2007) -- Added test case 546 to check that subsequent FTP transfers work after a - failed one using the multi interface - -Daniel S (29 October 2007) -- Based on one of those bug reports that are intercepted by a distro's bug - tracker (https://bugzilla.redhat.com/show_bug.cgi?id=316191), I now made - curl-config --features and --protocols show the correct output when built - with NSS. - -Version 7.17.1 (29 October 2007) - -Dan F (25 October 2007) -- Added the --static-libs option to curl-config - -Daniel S (25 October 2007) -- Made libcurl built with NSS possible to ignore the peer verification. - Previously it would fail if the ca bundle wasn't present, even if the code - ignored the verification results. - -Patrick M (25 October 2007) -- Fixed test server to allow null bytes in binary posts. -_ Added tests 35, 544 & 545 to check binary data posts, both static (in place) - and dynamic (copied). - -Daniel S (25 October 2007) -- Michal Marek fixed the test script to be able to use valgrind even when the - lib is built shared with libtool. - -- Fixed a few memory leaks when the same easy handle is re-used to request - URLs with different protocols. FTP and TFTP related leaks. Caught thanks to - Dan F's new test cases. - -Dan F (24 October 2007) -- Fixed the test FTP and TFTP servers to support the >10000 test number - notation - -- Added test cases 2000 through 2003 which test multiple protocols using the - same easy handle - -- Fixed the filecheck: make target to work outside the source tree - -Daniel S (24 October 2007) -- Vladimir Lazarenko pointed out that we should do some 'mt' magic when - building with VC8 to get the "manifest" embedded to make fine stand-alone - binaries. The maketgz and the src/Makefile.vc6 files were adjusted - accordingly. - -Daniel S (23 October 2007) -- Bug report #1812190 (https://curl.haxx.se/bug/view.cgi?id=1812190) points out - that libcurl tried to re-use connections a bit too much when using non-SSL - protocols tunneled over a HTTP proxy. - -Daniel S (22 October 2007) -- Michal Marek forwarded the bug report - https://bugzilla.novell.com/show_bug.cgi?id=332917 about a HTTP redirect to - FTP that caused memory havoc. His work together with my efforts created two - fixes: - - #1 - FTP::file was moved to struct ftp_conn, because is has to be dealt with - at connection cleanup, at which time the struct HandleData could be - used by another connection. - Also, the unused char *urlpath member is removed from struct FTP. - - #2 - provide a Curl_reset_reqproto() function that frees - data->reqdata.proto.* on connection setup if needed (that is if the - SessionHandle was used by a different connection). - - A long-term goal is of course to somehow get rid of how the reqdata struct - is used, as it is too error-prone. - -- Bug report #1815530 (https://curl.haxx.se/bug/view.cgi?id=1815530) points out - that specifying a proxy with a trailing slash didn't work (unless it also - contained a port number). - -Patrick M (15 October 2007) -- Fixed the dynamic CURLOPT_POSTFIELDS problem: this option is now static again - and option CURLOPT_COPYPOSTFIELDS has been added to support dynamic mode. - -Patrick M (12 October 2007) -- Added per-protocol callback static tables, replacing callback ptr storage - in the connectdata structure by a single handler table ptr. - -Dan F (11 October 2007) -- Fixed the -l option of runtests.pl - -- Added support for skipping tests based on key words. - -Daniel S (9 October 2007) -- Michal Marek removed the no longer existing return codes from the curl.1 - man page. - -Daniel S (7 October 2007) -- Known bug #47, which confused libcurl if doing NTLM auth over a proxy with - a response that was larger than 16KB is now improved slightly so that now - the restriction at 16KB is for the headers only and it should be a rare - situation where the response-headers exceed 16KB. Thus, I consider #47 fixed - and the header limitation is now known as known bug #48. - -Daniel S (5 October 2007) -- Michael Wallner made the CULROPT_COOKIELIST option support a new magic - string: "FLUSH". Using that will cause libcurl to flush its cookies to the - CURLOPT_COOKIEJAR file. - -- The new file docs/libcurl/ABI describes how we view ABI breakages, soname - bumps and what the version number's significance to all that is. - -Daniel S (4 October 2007) -- I enabled test 1009 and made the --local-port use a wide range to reduce the - risk of failures. - -- Kim Rinnewitz reported that --local-port didn't work with TFTP transfers. - This happened because the tftp code always uncondionally did a bind() - without caring if one already had been done and then it failed. I wrote a - test case (1009) to verify this, but it is a bit error-prone since it will - have to pick a fixed local port number and since the tests are run on so - many different hosts in different situations I'll add it in disabled state. - -Yang Tse (3 October 2007) -- Fixed issue related with the use of ares_timeout() result. - -Daniel S (3 October 2007) -- Alexey Pesternikov introduced CURLOPT_OPENSOCKETFUNCTION and - CURLOPT_OPENSOCKETDATA to set a callback that allows an application to - replace the socket() call used by libcurl. It basically allows the app to - change address, protocol or whatever of the socket. - -- I renamed the CURLE_SSL_PEER_CERTIFICATE error code to - CURLE_PEER_FAILED_VERIFICATION (standard CURL_NO_OLDIES style), and made - this return code get used by the previous SSH MD5 fingerprint check in case - it fails. - -- Based on a patch brought by Johnny Luong, libcurl now offers - CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 and the curl tool --hostpubmd5. They both - make the SCP or SFTP connection verify the remote host's md5 checksum of the - public key before doing a connect, to reduce the risk of a man-in-the-middle - attack. - -Daniel S (2 October 2007) -- libcurl now handles chunked-encoded CONNECT responses - -Daniel S (1 October 2007) -- Alex Fishman reported a curl_easy_escape() problem that was made the - function do wrong on all input bytes that are >= 0x80 (decimal 128) due to a - signed / unsigned mistake in the code. I fixed it and added test case 543 to - verify. - -Daniel S (29 September 2007) -- Immanuel Gregoire fixed a problem with persistent transfers over SFTP. - -Daniel S (28 September 2007) -- Adapted the c-ares code to the API change c-ares 1.5.0 brings in the - notifier callback(s). - -Dan F (26 September 2007) -- Enabled a few more gcc warnings with --enable-debug. Renamed a few - variables to avoid shadowing global declarations. - -Daniel S (26 September 2007) -- Philip Langdale provided the new CURLOPT_POST301 option for - curl_easy_setopt() that alters how libcurl functions when following - redirects. It makes libcurl obey the RFC2616 when a 301 response is received - after a non-GET request is made. Default libcurl behaviour is to change - method to GET in the subsequent request (like it does for response code 302 - - because that's what many/most browsers do), but with this CURLOPT_POST301 - option enabled it will do what the spec says and do the next request using - the same method again. I.e keep POST after 301. - - The curl tool got this option as --post301 - - Test case 1011 and 1012 were added to verify. - -- Max Katsev reported that when doing a libcurl FTP request with - CURLOPT_NOBODY enabled but not CURLOPT_HEADER, libcurl wouldn't do TYPE - before it does SIZE which makes it less useful. I walked over the code and - made it do this properly, and added test case 542 to verify it. - -Daniel S (24 September 2007) -- Immanuel Gregoire fixed KNOWN_BUGS #44: --ftp-method nocwd did not handle - URLs ending with a slash properly (it should list the contents of that - directory). Test case 351 brought back and also test 1010 was added. - -Daniel S (21 September 2007) -- Mark Davies fixed Negotiate authentication over proxy, and also introduced - the --proxy-negotiate command line option to allow a user to explicitly - select it. - -Daniel S (19 September 2007) -- Rob Crittenden provided an NSS update with the following highlights: - - o It looks for the NSS database first in the environment variable SSL_DIR, - then in /etc/pki/nssdb, then it initializes with no database if neither of - those exist. - - o If the NSS PKCS#11 libnspsem.so driver is available then PEM files may be - loaded, including the ca-bundle. If it is not available then only - certificates already in the NSS database are used. - - o Tries to detect whether a file or nickname is being passed in so the right - thing is done - - o Added a bit of code to make the output more like the OpenSSL module, - including displaying the certificate information when connecting in - verbose mode - - o Improved handling of certificate errors (expired, untrusted, etc) - - The libnsspem.so PKCS#11 module is currently only available in Fedora - 8/rawhide. Work will be done soon to upstream it. The NSS module will work - with or without it, all that changes is the source of the certificates and - keys. - -Daniel S (18 September 2007) -- Immanuel Gregoire pointed out that public key SSH auth failed if no - public/private key was specified and there was no HOME environment variable, - and then it didn't continue to try the other auth methods. Now it will - instead try to get the files id_dsa.pub and id_dsa from the current - directory if none of the two conditions were met. - -Dan F (17 September 2007) -- Added hooks to the test suite to make it possible to test a curl running - on a remote host. - -- Changed some FTP tests to validate the format of the PORT and EPRT commands - sent by curl, if not the addresses themselves. - -Daniel S (15 September 2007) -- Michal Marek made libcurl automatically append ";type=<a|i>" when using HTTP - proxies for FTP urls. - -- Günter Knauf fixed LDAP builds in the Windows makefiles and fixed LDAPv3 - support on Windows. - -Dan F (13 September 2007) -- Added LDAPS, SCP and SFTP to curl-config --protocols. Removed and - fixed some AC_SUBST configure entries. - -Version 7.17.0 (13 September 2007) - -Daniel S (12 September 2007) -- Bug report #1792649 (https://curl.haxx.se/bug/view.cgi?id=1792649) pointed - out a problem with doing an empty upload over FTP on a re-used connection. - I added test case 541 to reproduce it and to verify the fix. - -- I noticed while writing test 541 that the FTP code wrongly did a CWD on the - second transfer as it didn't store and remember the "" path from the - previous transfer so it would instead CWD to the entry path as stored. This - worked, but did a superfluous command. Thus, test case 541 now also verifies - this fix. - -Dan F (5 September 2007) -- Added test case 1007 to test permission problem when uploading with TFTP - (to validate bug #1790403). - -- TFTP now reports the "not defined" TFTP error code 0 as an error, - not success. - -Daniel S (5 September 2007) -- Continued the work on a fix for #1779054 - (https://curl.haxx.se/bug/view.cgi?id=1779054). My previous fix from August - 24 was not complete (either) but could accidentally "forget" parts of a - server response which led to faulty server response time-out errors. - -Dan F (5 September 2007) -- Minix doesn't support getsockopt on UDP sockets or send/recv on TCP - sockets. - -Dan F (31 August 2007) -- Made some of the error strings returned by the *strerror functions more - generic, and more consistent with each other. - -- Renamed the curl_ftpssl enum to curl_usessl and its enumerated constants, - creating macros for backward compatibility: - - CURLFTPSSL_NONE => CURLUSESSL_NONE - CURLFTPSSL_TRY => CURLUSESSL_TRY - CURLFTPSSL_CONTROL => CURLUSESSL_CONTROL - CURLFTPSSL_ALL => CURLUSESSL_ALL - CURLFTPSSL_LAST => CURLUSESSL_LAST - -Dan F (30 August 2007) -- Renamed several libcurl error codes and options to make them more general - and allow reuse by multiple protocols. Several unused error codes were - removed. In all cases, macros were added to preserve source (and binary) - compatibility with the old names. These macros are subject to removal at - a future date, but probably not before 2009. An application can be - tested to see if it is using any obsolete code by compiling it with the - CURL_NO_OLDIES macro defined. - - The following unused error codes were removed: - - CURLE_BAD_CALLING_ORDER - CURLE_BAD_PASSWORD_ENTERED - CURLE_FTP_CANT_RECONNECT - CURLE_FTP_COULDNT_GET_SIZE - CURLE_FTP_COULDNT_SET_ASCII - CURLE_FTP_USER_PASSWORD_INCORRECT - CURLE_FTP_WEIRD_USER_REPLY - CURLE_FTP_WRITE_ERROR - CURLE_LIBRARY_NOT_FOUND - CURLE_MALFORMAT_USER - CURLE_OBSOLETE - CURLE_SHARE_IN_USE - CURLE_URL_MALFORMAT_USER - - The following error codes were renamed: - - CURLE_FTP_ACCESS_DENIED => CURLE_REMOTE_ACCESS_DENIED - CURLE_FTP_COULDNT_SET_BINARY => CURLE_FTP_COULDNT_SET_TYPE - CURLE_FTP_SSL_FAILED => CURLE_USE_SSL_FAILED - CURLE_FTP_QUOTE_ERROR => CURLE_QUOTE_ERROR - CURLE_TFTP_DISKFULL => CURLE_REMOTE_DISK_FULL - CURLE_TFTP_EXISTS => CURLE_REMOTE_FILE_EXISTS - CURLE_HTTP_RANGE_ERROR => CURLE_RANGE_ERROR - - The following options were renamed: - - CURLOPT_SSLKEYPASSWD => CURLOPT_KEYPASSWD - CURLOPT_FTPAPPEND => CURLOPT_APPEND - CURLOPT_FTPLISTONLY => CURLOPT_DIRLISTONLY - CURLOPT_FTP_SSL => CURLOPT_USE_SSL - - A few more changes will take place with the next SONAME bump of the - library. These are documented in docs/TODO - -- Documented some newer error codes in libcurl-error(3) - -- Added more accurate error code returns from SFTP operations. Added test - case 615 to test an SFTP upload failure. - -Dan F (28 August 2007) -- Some minor internal type and const changes based on a splint scan. - -Daniel S (24 August 2007) -- Bug report #1779054 (https://curl.haxx.se/bug/view.cgi?id=1779054) pointed - out that libcurl didn't deal with large responses from server commands, when - the single response was consisting of multiple lines but of a total size of - 16KB or more. Dan Fandrich improved the ftp test script and provided test - case 1006 to repeat the problem, and I fixed the code to make sure this new - test case runs fine. - -Patrick M (23 August 2007) -- OS/400 port: new files lib/config-os400.h lib/setup-os400.h packages/OS400/*. - See packages/OS400/README.OS400. - -Daniel S (23 August 2007) -- Bug report #1779751 (https://curl.haxx.se/bug/view.cgi?id=1779751) pointed - out that doing first a file:// upload and then an FTP upload crashed libcurl - or at best caused furious valgrind complaints. Fixed now! - -Daniel S (22 August 2007) -- Bug report #1779054 (https://curl.haxx.se/bug/view.cgi?id=1779054) pointed - out that libcurl didn't deal with very long (>16K) FTP server response lines - properly. Starting now, libcurl will chop them off (thus the client app will - not get the full line) but survive and deal with them fine otherwise. Test - case 1003 was added to verify this. - -Daniel S (20 August 2007) -- Based on a patch by Christian Vogt, the FTP code now sets the upcoming - download transfer size much earlier to be possible to get read with - CURLINFO_CONTENT_LENGTH_DOWNLOAD as soon as possible. This is very much in a - similar spirit to the HTTP size change from August 11 2007. - -Daniel S (18 August 2007) -- Robson Braga Araujo filed bug report #1776232 - (https://curl.haxx.se/bug/view.cgi?id=1776232) about libcurl calling - Curl_client_write(), passing on a const string that the caller may not - modify and yet it does (on some platforms). - -- Robson Braga Araujo filed bug report #1776235 - (https://curl.haxx.se/bug/view.cgi?id=1776235) about ftp requests with NOBODY - on a directory would do a "SIZE (null)" request. This is now fixed and test - case 1000 was added to verify. - -Daniel S (17 August 2007) -- Song Ma provided a patch that cures a problem libcurl has when doing resume - HTTP PUT using Digest authentication. Test case 5320 and 5322 were also - added to verify the functionality. - -Daniel S (14 August 2007) -- Andrew Wansink provided an NTLM bugfix: in the case the server sets the flag - NTLMFLAG_NEGOTIATE_UNICODE, we need to filter it off because libcurl doesn't - UNICODE encode the strings it packs into the NTLM authenticate packet. - -Daniel S (11 August 2007) -- Allen Pulsifer provided a patch that makes libcurl set the expected download - size earlier when doing HTTP downloads, so that applications and the - progress meter etc know get the info earlier in the flow than before. - -- Patrick Monnerat modified the LDAP code and approach in curl. Starting now, - the configure script checks for openldap and friends and we link with those - libs just like we link all other third party libraries, and we no longer - dlopen() those libraries. Our private header file lib/ldap.h was renamed to - lib/curl_ldap.h due to this. I set a tag in CVS (curl-7_17_0-preldapfix) - just before this commit, just in case. - -Dan F (8 August 2007) -- Song Ma noted a zlib memory leak in the illegal compressed header - countermeasures code path. - -Daniel S (4 August 2007) -- Patrick Monnerat fixed curl_easy_escape() and curlx_strtoll() to work on - non-ASCII systems. - -Daniel S (3 August 2007) -- I cut out support for libssh2 versions older than 0.16 to make our code a - lot simpler, and to avoid getting trouble with the LIBSSH2_APINO define - that 1) didn't work properly since it was >32 bits and 2) is removed in - libssh2 0.16... - -Daniel S (2 August 2007) -- Scott Cantor filed bug report #1766320 - (https://curl.haxx.se/bug/view.cgi?id=1766320) pointing out that the libcurl - code accessed two curl_easy_setopt() options (CURLOPT_DNS_CACHE_TIMEOUT and - CURLOPT_DNS_USE_GLOBAL_CACHE) as ints even though they're documented to be - passed in as longs, and that makes a difference on 64 bit architectures. - -- Dmitriy Sergeyev reported a regression: resumed file:// transfers broke - after 7.16.2. This is much due to the different treatment file:// gets - internally, but now I added test 231 to make it less likely to happen again - without us noticing! - -Daniel S (1 August 2007) -- Patrick Monnerat and I modified libcurl so that now it *copies* all strings - passed to it with curl_easy_setopt()! Previously it has always just refered - to the data, forcing the user to keep the data around until libcurl is done - with it. That is now history and libcurl will instead clone the given - strings and keep private copies. This is also part of Patrick Monnerat's - OS/400 port. - - Due to this being a somewhat interesting change API wise, I've decided to - bump the version of the upcoming release to 7.17.0. Older applications will - of course not notice this change nor do they have to care, but new - applications can be written to take advantage of this. - -- Greg Morse reported a problem with POSTing using ANYAUTH to a server - requiring NTLM, and he provided test code and a test server and we worked - out a bug fix. We failed to count sent body data at times, which then caused - internal confusions when libcurl tried to send the rest of the data in order - to maintain the same connection alive. - -Daniel S (31 July 2007) -- Peter O'Gorman pointed out (and fixed) that the non-blocking check in - configure made libcurl use blocking sockets on AIX 4 and 5, while that - wasn't the intention. - -Daniel S (29 July 2007) -- Jayesh A Shah filed bug report #1759542 - (https://curl.haxx.se/bug/view.cgi?id=1759542) identifying a rather serious - problem with FTPS: libcurl closed the data connection socket and then later - in the flow it would call the SSL layer to do SSL shutdown which then would - use a socket that had already been closed - so if the application had opened - a new one in the mean time, libcurl could send gibberish that way! I worked - with Greg Zavertnik to properly diagnose and fix this. The fix affects code - for all SSL libraries we support, but it has only been truly verified to - work fine for the OpenSSL version. The others have only been code reviewed. - -Daniel S (23 July 2007) -- Implemented the parts of Patrick Monnerat's OS/400 patch that introduces - support for the OS/400 Secure Sockets Layer library. - -Dan F (23 July 2007) -- Implemented only the parts of Patrick Monnerat's OS/400 patch that renamed - some few internal identifiers to avoid conflicts, which could be useful on - other platforms. - -Daniel S (22 July 2007) -- HTTP Digest bug fix by Chris Flerackers: - - Scenario - - - Perfoming a POST request with body - - With authentication (only Digest) - - Re-using a connection - - libcurl would send a HTTP POST with an Authorization header but without - body. Our server would return 400 Bad Request in that case (because - authentication passed, but the body was empty). - - Cause - - 1) http_digest.c -> Curl_output_digest - - Updates allocptr.userpwd/allocptr.proxyuserpwd *only* if d->nonce is - filled in (and no errors) - - authp->done = TRUE if d->nonce is filled in - 2) http.c -> Curl_http - - *Always* uses allocptr.userpwd/allocptr.proxyuserpwd if not NULL - 3) http.c -> Curl_http, Curl_http_output_auth - - So what happens is that Curl_output_digest cannot yet update the - Authorization header (allocptr.userpwd) which results in authhost->done=0 -> - authhost->multi=1 -> conn->bits.authneg = TRUE. The body is not - added. *However*, allocptr.userpwd is still used when building the request - -- Added test case 354 that makes a simple FTP retrieval without password, which - verifies the bug fix in #1757328. - -Daniel S (21 July 2007) -- To allow more flexibility in FTP test cases, I've removed the enforced states - from the test server code as they served no real purpose. The test server - is here to serve for the test cases, not to attempt to function as a real - server! While at it, I modified test case 141 to better test and verify - curl -I on a single FTP file. - -Daniel S (20 July 2007) -- James Housley fixed the SFTP PWD command to work. - -- Ralf S. Engelschall filed bug report #1757328 - (https://curl.haxx.se/bug/view.cgi?id=1757328) and submitted a patch. It - turns out we broke login to FTP servers that don't require (nor understand) - PASS after the USER command. The breakage was done as part of the krb5 - commit so a krb-using person needs to verify that the current version now - works or if we need to fix it (in a different way of course). - -Dan F (17 July 2007) -- Fixed test cases 613 and 614 by improving the log postprocessor to handle - a new directory listing format that newer libssh2's can provide. This - is probably NOT sufficient to handle all directory listing formats that - server's can provide, and should be revisited. - -Daniel S (17 July 2007) -- Daniel Johnson fixed a bug in how libssh2_session_last_error() was used, in - two places. - -- Jofell Gallardo posted a libcurl log using FTP that exposed a bug which made - a control connection that was deemed "dead" to yet be re-used in a following - request. - -Daniel S (13 July 2007) -- Colin Hogben filed bug report #1750274 - (https://curl.haxx.se/bug/view.cgi?id=1750274) and submitted a patch for the - case where libcurl did a connect attempt to a non-listening port and didn't - provide a human readable error string back. - -- Daniel Cater fixes: - 1 - made 'make vc8' work on windows. - 2 - made libcurl itself built with CURL_NO_OLDIES defined (which doesn't - define the symbols for backwards source compatibility) - 3 - updated libcurl-errors.3 - 4 - added CURL_DISABLE_TFTP to docs/INSTALL - -Daniel S (12 July 2007) -- Made the krb5 code build with Heimdal's GSSAPI lib. - -Dan F (12 July 2007) -- Compile most of the example apps in docs/examples when doing a 'make check'. - Fixed some compile warnings and errors in those examples. - -- Removed the example program ftp3rdparty.c since libcurl doesn't support - 3rd party FTP transfers any longer. - -Daniel S (12 July 2007) -- Shmulik Regev found an (albeit rare) case where the proxy CONNECT operation - could in fact get stuck in an endless loop. - -- Made CURLOPT_SSL_VERIFYHOST set to 1 acts as described in the documentation: - fail to connect if there is no Common Name field found in the remote cert. - We should deprecate the support for this set to 1 anyway soon, since the - feature is pointless and most likely never really used by anyone. - -Daniel S (11 July 2007) -- Shmulik Regev fixed a bug with transfer-encoding skipping during the 407 - error pages for proxy authentication. - -- Giancarlo Formicuccia reported and fixed a problem with a closed connection - to a proxy during CONNECT auth negotiation. - -Dan F (10 July 2007) -- Fixed a curl memory leak reported by Song Ma with a modified version - of the patch he suggested. Added his test case as test289 to verify. - -- Force the time zone to GMT in the cookie tests in case the user is - using one of the so-called 'right' time zones that take into account - leap seconds, which causes the tests to fail (as reported by - Daniel Black in bug report #1745964). - -Version 7.16.4 (10 July 2007) - -Daniel S (10 July 2007) -- Kees Cook notified us about a security flaw - (https://curl.haxx.se/docs/adv_20070710.html) in which libcurl failed to - properly reject some outdated or not yet valid server certificates when - built with GnuTLS. Kees also provided the patch. - -James H (5 July 2007) -- Gavrie Philipson provided a patch that will use a more specific error - message for an scp:// upload failure. If libssh2 has his matching - patch, then the error message return by the server will be used instead - of a more generic error. - -Daniel S (1 July 2007) -- Thomas J. Moore provided a patch that introduces Kerberos5 support in - libcurl. This also makes the options change name to --krb (from --krb4) and - CURLOPT_KRBLEVEL (from CURLOPT_KRB4LEVEL) but the old names are still - -- Song Ma helped me verify and extend a fix for doing FTP over a SOCKS4/5 - proxy. - -Daniel S (27 June 2007) -- James Housley: Add two new options for the SFTP/SCP/FILE protocols: - CURLOPT_NEW_FILE_PERMS and CURLOPT_NEW_DIRECTORY_PERMS. These control the - premissions for files and directories created on the remote - server. CURLOPT_NEW_FILE_PERMS defaults to 0644 and - CURLOPT_NEW_DIRECTORY_PERMS defaults to 0755 - -- I corrected the 10-at-a-time.c example and applied a patch for it by James - Bursa. - -Daniel S (26 June 2007) -- Robert Iakobashvili re-arranged the internal hash code to work with a custom - hash function for different hashes, and also expanded the default size for - the socket hash table used in multi handles to greatly enhance speed when - very many connections are added and the socket API is used. - -- James Housley made the CURLOPT_FTPLISTONLY mode work for SFTP directory - listings as well - -Daniel S (25 June 2007) -- Adjusted how libcurl treats HTTP 1.1 responses without content-lenth or - chunked encoding (that also lacks "Connection: close"). It now simply - assumes that the connection WILL be closed to signal the end, as that is how - RFC2616 section 4.4 point #5 says we should behave. - -Version 7.16.3 (25 June 2007) - -Daniel S (23 June 2007) -- As reported by "Tro" in https://curl.haxx.se/mail/lib-2007-06/0161.html and - https://curl.haxx.se/mail/lib-2007-06/0238.html, libcurl didn't properly do - no-body requests on FTP files on re-used connections properly, or at least - it didn't provide the info back in the header callback properly in the - subsequent requests. - -Daniel S (21 June 2007) -- Gerrit Bruchhäuser pointed out a warning that the Intel(R) Thread Checker - tool reports and it was indeed a legitimate one and it is one fixed. It was - a use of a share without doing the proper locking first. - -Daniel S (20 June 2007) -- Adam Piggott filed bug report #1740263 - (https://curl.haxx.se/bug/view.cgi?id=1740263). Adam discovered that when - getting a large amount of URLs with curl, they were fetched slower and - slower... which turned out to be because the --libcurl data collecting which - wrongly always was enabled, but no longer is... - -Daniel S (18 June 2007) -- Robson Braga Araujo filed bug report #1739100 - (https://curl.haxx.se/bug/view.cgi?id=1739100) that mentioned that libcurl - could not actually list the contents of the root directory of a given FTP - server if the login directory isn't root. I fixed the problem and added - three test cases (one is disabled for now since I identified KNOWN_BUGS #44, - we cannot use --ftp-method nocwd and list ftp directories). - -Daniel S (14 June 2007) -- Shmulik Regev: - - I've encountered (and hopefully fixed) a problem involving proxy CONNECT - requests and easy handles state management. The problem isn't simple to - reproduce since it depends on socket state. It only manifests itself when - working with non-blocking sockets. - - Here is the scenario: - - 1. in multi_runsingle the easy handle is in the CURLM_STATE_WAITCONNECT and - calls Curl_protocol_connect - - 2. in Curl_proxyCONNECT, line 1247, if the socket isn't ready the function - returns and conn->bits.tunnel_connecting is TRUE - - 3. when the call to Curl_protocol_connect returns the protocol_connect flag - is false and the easy state is changed to CURLM_STATE_PROTOCONNECT which - isn't correct if a proxy is used. Rather CURLM_STATE_WAITPROXYCONNECT - should be used. - - I discovered this while performing an HTTPS request through a proxy (squid) - on my local network. The problem caused openssl to fail as it read the proxy - response to the CONNECT call ('HTTP/1.0 Established') rather than the SSL - handshake (the exact openssl error was 'wrong ssl version' but this isn't - very important) - -- Dave Vasilevsky filed bug report #1736875 - (https://curl.haxx.se/bug/view.cgi?id=1736875) almost simultanouesly as Dan - Fandrich mentioned a related build problem on the libcurl mailing list: - https://curl.haxx.se/mail/lib-2007-06/0131.html. Both problems had the same - reason: the definitions of the POLL* defines and the pollfd struct in the - libcurl code was depending on HAVE_POLL instead of HAVE_SYS_POLL_H. - -Daniel S (13 June 2007) -- Tom Regner provided a patch and worked together with James Housley, so now - CURLOPT_FTP_CREATE_MISSING_DIRS works for SFTP connections as well as FTP - ones. - -- Rich Rauenzahn filed bug report #1733119 - (https://curl.haxx.se/bug/view.cgi?id=1733119) and we collaborated on the - fix. The problem is that for 64bit HPUX builds, several socket-related - functions would still assume int (32 bit) arguments and not socklen_t (64 - bit) ones. - -Daniel S (12 June 2007) -- James Housley brought his revamped SSH code that is state-machine driven to - really take advantage of the now totally non-blocking libssh2 (in CVS). - -Dan F (8 June 2007) -- Incorporated Daniel Black's test706 and test707 SOCKS test cases. - -- Fixed a few problems when starting the SOCKS server. - -- Reverted some recent changes to runtests.pl that weren't compatible with - perl 5.0. - -- Fixed the test harness so that it actually kills the ssh being used as - the SOCKS server. - -Daniel S (6 June 2007) -- -s/--silent can now be used to toggle off the silence again if used a second - time. - -Daniel S (5 June 2007) -- Added Daniel Black's work that adds the first few SOCKS test cases. I also - fixed two minor SOCKS problems to make the test cases run fine. - -Daniel S (31 May 2007) -- Feng Tu made (lib)curl support "upload" resuming work for file:// URLs. - -Daniel S (30 May 2007) -- I modified the 10-at-a-time.c example to transfer 500 downloads in parallel - with a c-ares enabled build only to find that it crashed miserably, and this - was due to some select()isms left in the code. This was due to API - restrictions in c-ares 1.3.x, but with the upcoming c-ares 1.4.0 this is no - longer the case so now libcurl runs much better with c-ares and the multi - interface with > 1024 file descriptors in use. - - Extra note: starting now we require c-ares 1.4.0 for asynchronous name - resolves. - -- Added CURLMOPT_MAXCONNECTS which is a curl_multi_setopt() option for setting - the maximum size of the connection cache maximum size of the multi handle. - -Daniel S (27 May 2007) -- When working with a problem Stefan Becker had, I found an off-by-one buffer - overwrite in Curl_select(). While fixing it, I also improved its performance - somewhat by changing calloc to malloc and breaking out of a loop earlier - (when possible). - -Daniel S (25 May 2007) -- Rob Crittenden fixed bug #1705802 - (https://curl.haxx.se/bug/view.cgi?id=1705802), which was filed by Daniel - Black identifying several FTP-SSL test cases fail when we build libcurl with - NSS for TLS/SSL. Listed as #42 in KNOWN_BUGS. - -Daniel S (24 May 2007) -- Song Ma filed bug report #1724016 - (https://curl.haxx.se/bug/view.cgi?id=1724016) noticing that downloading - glob-ranges for TFTP was broken in CVS. Fixed now. - -- 'mytx' in bug report #1723194 (https://curl.haxx.se/bug/view.cgi?id=1723194) - pointed out that the warnf() function in the curl tool didn't properly deal - with the cases when excessively long words were used in the string to chop - up. - -Daniel S (22 May 2007) -- Andre Guibert de Bruet fixed a memory leak in the function that verifies the - peer's name in the SSL certificate when built for OpenSSL. The leak happens - for libcurls with CURL_DOES_CONVERSIONS enabled that fail to convert the CN - name from UTF8. He also fixed a leak when PKCS #12 parsing failed. - -Daniel S (18 May 2007) -- Feng Tu reported that curl -w did wrong on TFTP transfers in bug report - #1715394 (https://curl.haxx.se/bug/view.cgi?id=1715394), and the - transfer-related info "variables" were indeed overwritten with zeroes - wrongly and have now been adjusted. The upload size still isn't accurate. - -Daniel S (17 May 2007) -- Feng Tu pointed out a division by zero error in the TFTP connect timeout - code for timeouts less than five seconds, and also provided a fix for it. - Bug report #1715392 (https://curl.haxx.se/bug/view.cgi?id=1715392) - -Dan F (16 May 2007) -- Added support for compiling under Minix 3.1.3 using ACK. - -Dan F (14 May 2007) -- Added SFTP directory listing test case 613. - -- Added support for quote commands before a transfer using SFTP and test - case 614. - -- Changed the post-quote commands to occur after the transferred file is - closed. - -- Allow SFTP quote commands chmod, chown, chgrp to set a value of 0. - -Dan F (9 May 2007) -- Kristian Gunstone fixed a problem where overwriting an uploaded file with - sftp didn't truncate it first, which would corrupt the file if the new - file was shorter than the old. - -Dan F (8 May 2007) -- Added FTPS test cases 406 and 407 - -Daniel S (8 May 2007) -- CURLE_FTP_COULDNT_STOR_FILE is now known as CURLE_UPLOAD_FAILED. This is - because I just made SCP uploads return this value if the file size of - the upload file isn't given with CURLOPT_INFILESIZE*. Docs updated to - reflect this news, and a define for the old name was added to the public - header file. - -Daniel S (7 May 2007) -- James Bursa fixed a bug in the multi handle code that made the connection - cache grow a bit too much, beyond the normal 4 * easy_handles. - -Daniel S (2 May 2007) -- Anders Gustafsson remarked that requiring CURLOPT_HTTP_VERSION set to 1.0 - when CURLOPT_HTTP200ALIASES is used to avoid the problem mentioned below is - not very nice if the client wants to be able to use _either_ a HTTP 1.1 - server or one within the aliases list... so starting now, libcurl will - simply consider 200-alias matches the to be HTTP 1.0 compliant. - -- Tobias Rundström reported a problem they experienced with xmms2 and recent - libcurls, which turned out to be the 25-nov-2006 change which treats HTTP - responses without Content-Length or chunked encoding as without bodies. We - now added the conditional that the above mentioned response is only without - body if the response is HTTP 1.1. - -- Jeff Pohlmeyer improved the hiperfifo.c example to use the - CURLMOPT_TIMERFUNCTION callback option. - -- Set the timeout for easy handles to expire really soon after addition or - when CURLM_CALL_MULTI_PERFORM is returned from curl_multi_socket*/perform, - to make applications using only curl_multi_socket() to properly function - when adding easy handles "on the fly". Bug report and test app provided by - Michael Wallner. - -Dan F (30 April 2007) -- Improved the test harness to allow running test servers on other than - the default port numbers, allowing more than one test suite to run - simultaneously on the same host. - -Daniel S (28 April 2007) -- Peter O'Gorman fixed libcurl to not init GnuTLS as early as we did before, - since it then inits libgcrypt and libgcrypt is being evil and EXITS the - application if it fails to get a fine random seed. That's really not a nice - thing to do by a library. - -- Frank Hempel fixed a curl_easy_duphandle() crash on a handle that had - been removed from a multi handle, and then fixed another flaw that prevented - curl_easy_duphandle() to work even after the first fix - the handle was - still marked as using the multi interface. - -Daniel S (26 April 2007) -- Peter O'Gorman found a problem with SCP downloads when the downloaded file - was 16385 bytes (16K+1) and it turned out we didn't properly always "suck - out" all data from libssh2. The effect being that libcurl would hang on the - socket waiting for data when libssh2 had in fact already read it all... - -Dan F (25 April 2007) -- Added support in runtests.pl for "!n" test numbers to disable individual - tests. Changed -t to only keep log files around when -k is specified, - to have the same behaviour as without -t. - -Daniel S (25 April 2007) -- Sonia Subramanian brought our attention to a problem that happens if you set - the CURLOPT_RESUME_FROM or CURLOPT_RANGE options and an existing connection - in the connection cache is closed to make room for the new one when you call - curl_easy_perform(). It would then wrongly free range-related data in the - connection close funtion. - -Yang Tse (25 April 2007) -- Steve Little fixed compilation on VMS 64-bit mode - -Daniel S (24 April 2007) -- Robert Iakobashvili made the 'master_buffer' get allocated first once it is - can/will be used as it then makes the common cases save 16KB of data for each - easy handle that isn't used for pipelining. - -Dan F (23 April 2007) -- Added <postcheck> support to the test harness. - -- Added tests 610-612 to test more SFTP post-quote commands. - -Daniel S (22 April 2007) -- Song Ma's warning if -r/--range is given with a "bad" range, also noted in - the man page now. - -- Daniel Black filed bug #1705177 - (https://curl.haxx.se/bug/view.cgi?id=1705177) where --without-ssl - --with-gnutl outputs a warning about SSL not being enabled even though GnuTLS - was found and used. - -Daniel S (21 April 2007) -- Daniel Black filed bug #1704675 - (https://curl.haxx.se/bug/view.cgi?id=1704675) identifying a double-free - problem in the SSL-dealing layer, telling GnuTLS to free NULL credentials on - closedown after a failure and a bad #ifdef for NSS when closing down SSL. - -Yang Tse (20 April 2007) -- Save one call to curlx_tvnow(), which calls gettimeofday(), in each of - Curl_socket_ready(), Curl_poll() and Curl_select() when these are called - with a zero timeout or a timeout value indicating a blocking call should - be performed. - -Daniel S (18 April 2007) -- James Housley made SFTP uploads use libssh2's non-blocking API - -- Prevent the internal progress meter from updating more frequently than once - per second. - -Dan F (17 April 2007) -- Added test cases 296, 297 and 298 to test --ftp-method handling - -Daniel S (16 April 2007) -- Robert Iakobashvil added curl_multi_socket_action() to libcurl, which is a - function that deprecates the curl_multi_socket() function. Using the new - function the application tell libcurl what action that was found in the - socket that it passes in. This gives a significant performance boost as it - allows libcurl to avoid a call to poll()/select() for every call to - curl_multi_socket*(). - - I added a define in the public curl/multi.h header file that will make your - existing application automatically use curl_multi_socket_action() instead of - curl_multi_socket() when you recompile. But of course you'll get better - performance if you adjust your code manually and actually pass in the - correct action bitmask to this function. - -Daniel S (14 April 2007) -- Jay Austin added "DH PARAMETERS" to the stunnel.pem certificate for the test - suite to make stunnel run better in some (most?) environments. - -Dan F (13 April 2007) -- Added test cases 294 and 295 to test --ftp-account handling - -- Improved handling of out of memory in ftp. - -Yang Tse (13 April 2007) -- Fix test case 534 which started to fail 2007-04-13 due to the existance - of a new host on the net with the same silly domain the test was using - for a host which was supposed not to exist. - -Daniel S (12 April 2007) -- Song Ma found a memory leak in the if2ip code if you pass in an interface - name longer than the name field of the ifreq struct (typically 6 bytes), as - then it wouldn't close the used dummy socket. Bug #1698974 - (https://curl.haxx.se/bug/view.cgi?id=1698974) - -Version 7.16.2 (11 April 2007) - -Yang Tse (10 April 2007) -- Ravi Pratap provided some fixes for HTTP pipelining - -- configure script will ignore --enable-sspi option for non-native Windows. - -Daniel S (9 April 2007) -- Nick Zitzmann did ssh.c cleanups - -Daniel S (3 April 2007) -- Rob Jones fixed better #ifdef'ing for a bunch of #include lines. - -Daniel S (2 April 2007) -- Nick Zitzmann made the CURLOPT_POSTQUOTE option work for SFTP as well. The - accepted commands are as follows: - - chgrp (gid) (path) - Changes the group ID of the file or directory at (path) to (gid). (gid) - must be a number. - - chmod (perms) (path) - Changes the permissions of the file or directory at (path) to - (perms). (perms) must be a number in the format used by the chmod Unix - command. - - chown (uid) (path) - Changes the user ID of the file or directory at (path) to (uid). (uid) - must be a number. - - ln (source) (dest) - Creates a symbolic link at (dest) that points to the file located at - (source). - - mkdir (path) - Creates a new directory at (path). - - rename (source) (dest) - Moves the file or directory at (source) to (dest). - - rm (path) - Deletes the file located at (path). - - rmdir (path) - Deletes the directory located at (path). This command will raise an error - if the directory is not empty. - - symlink (source) (dest) - Same as ln. - -Daniel S (1 April 2007) -- Robert Iakobashvili made curl_multi_remove_handle() a lot faster when many - easy handles are added to a multi handle, by avoiding the looping over all - the handles to find which one to remove. - -- Matt Kraai provided a patch that makes curl build on QNX 6 fine again. - -Daniel S (31 March 2007) -- Fixed several minor issues detected by the coverity.com scanner. - -- "Pixel" fixed a problem that appeared when you used -f with user+password - embedded in the URL. - -Dan F (29 March 2007) -- Don't tear down the ftp connection if the maximum filesize was exceeded - and added tests 290 and 291 to check. - -- Added ftps upload and SSL required tests 401 and 402. - -- Send an EOF message before closing an SCP channel, as recommended by - RFC4254. Enable libssh2 tracing when ssh debugging is turned on. - -Yang Tse (27 March 2007) -- Internal function Curl_select() renamed to Curl_socket_ready() - - New Internal wrapper function Curl_select() around select (2), it - uses poll() when a fine poll() is available, so now libcurl can be - built without select() support at all if a fine poll() is available. - -Daniel S (25 March 2007) -- Daniel Johnson fixed multi code to traverse the easy handle list properly. - A left-over bug from the February 21 fix. - -Dan F (23 March 2007) -- Added --pubkey option to curl and made --key also work for SCP/SFTP, - plus made --pass work on an SSH private key as well. - -- Changed the test harness to attempt to gracefully shut down servers - before resorting to the kill -9 hammer. - -- Added test harness infrastructure to support scp/sftp tests, using - OpenSSH as the server. - -- Fixed a memory leak when specifying a proxy with a file: URL. - -Yang Tse (20 March 2007) -- Fixed: When a signal was caught awaiting for an event using Curl_select() - or Curl_poll() with a non-zero timeout both functions would restart the - specified timeout. This could even lead to the extreme case that if a - signal arrived with a frecuency lower to the specified timeout neither - function would ever exit. - - Added experimental symbol definition check CURL_ACKNOWLEDGE_EINTR in - Curl_select() and Curl_poll(). When compiled with CURL_ACKNOWLEDGE_EINTR - defined both functions will return as soon as a signal is caught. Use it - at your own risk, all calls to these functions in the library should be - revisited and checked before fully supporting this feature. - -Yang Tse (19 March 2007) -- Bryan Henderson fixed the progress function so that it can get called more - frequently allowing same calling frecuency for the client progress callback. - -Dan F (15 March 2007) -- Various memory leaks plugged and NULL pointer fixes made in the ssh code. - -Daniel (15 March 2007) -- Nick made the curl tool accept globbing ranges that only is one number, i.e - you can now use [1-1] without curl complaining. - -Daniel (10 March 2007) -- Eygene Ryabinkin: - - The problem is the following: when we're calling Curl_done and it decides to - keep the connection opened ('left intact'), then the caller is not notified - that the connection was done via the NULLifying of the pointer, so some easy - handle is keeping the pointer to this connection. - - Later ConnectionExists can select such connection for reuse even if we're - not pipelining: pipeLen is zero, so the (pipeLen > 0 && !canPipeline) is - false and we can reuse this connection for another easy handle. But thus the - connection will be shared between two easy handles if the handle that wants - to take the ownership is not the same as was not notified of the connection - was done in Curl_done. And when some of these easy handles will get their - connection really freed the another one will still keep the pointer. - - My fix was rather trivial: I just added the NULLification to the 'else' - branch in the Curl_done. My tests with Git and ElectricFence showed no - problems both for HTTP pulling and cloning. Repository size is about 250 Mb, - so it was a considerable amount of Curl's work. - -Dan F (9 March 2007) -- Updated the test harness to add a new "crypto" feature check and updated the - appropriate test case to use it. For now, this is treated the same as the - "SSL" feature because curl doesn't list it separately. - -Daniel (9 March 2007) -- Robert Iakobashvili fixed CURLOPT_INTERFACE for IPv6. - -- Robert A. Monat improved the maketgz and VC6/8 generating to set the correct - machine type too. - -- Justin Fletcher fixed a file descriptor leak in the curl tool when trying to - upload a file it couldn't open. Bug #1676581 - (https://curl.haxx.se/bug/view.cgi?id=1676581) - -Dan F (9 March 2007) -- Updated the test harness to check for protocol support before running each - test, fixing KNOWN_BUGS #11. - -Dan F (7 March 2007) -- Reintroduced (after a 3 year hiatus) an FTPS test case (400) into the test - harness. It is very limited as it supports only ftps:// URLs with - --ftp-ssl-control specified, which implicitly encrypts the control - channel but not the data channels. That allows stunnel to be used with - an unmodified ftp server in exactly the same way that the test https - server is set up. - -Dan F (7 March 2007) -- Honour --ftp-ssl-control on ftps:// URLs to allow encrypted control and - unencrypted data connections. - -Dan F (6 March 2007) -- Fixed a couple of improper pointer uses detected by valgrind in test - cases 181 & 216. - -Daniel (2 March 2007) -- Robert A. Monat and Shmulik Regev helped out to fix the new */Makefile.vc8 - makefiles that are included in the source release archives, generated from - the Makefile.vc6 files by the maketgz script. I also modified the root - Makefile to have a VC variable that defaults to vc6 but can be overridden to - allow it to be used for vc8 as well. Like this: - - nmake VC=vc8 vc - -Daniel (27 February 2007) -- Hang Kin Lau found and fixed: When I use libcurl to connect to an https - server through a proxy and have the remote https server port set using the - CURLOPT_PORT option, protocol gets reset to http from https after the first - request. - - User defined URL was modified internally by libcurl and subsequent reuse of - the easy handle may lead to connection using a different protocol (if not - originally http). - - I found that libcurl hardcoded the protocol to "http" when it tries to - regenerate the URL if CURLOPT_PORT is set. I tried to fix the problem as - follows and it's working fine so far - -Daniel (25 February 2007) -- Adam D. Moss made the HTTP CONNECT procedure less blocking when used from - the multi interface. Note that it still does a part of the connection in a - blocking manner. - -Daniel (23 February 2007) -- Added warning outputs if the command line uses more than one of the options - -v, --trace and --trace-ascii, since it could really confuse the user. - Clarified this fact in the man page. - -Daniel (21 February 2007) -- Ravi Pratap provided work on libcurl making pipelining more robust and - fixing some bugs: - o Don't mix GET and POST requests in a pipeline - o Fix the order in which requests are dispatched from the pipeline - o Fixed several curl bugs with pipelining when the server is returning - chunked encoding: - * Added states to chunked parsing for final CRLF - * Rewind buffer after parsing chunk with data remaining - * Moved chunked header initializing to a spot just before receiving - headers - -Daniel (20 February 2007) -- Linus Nielsen Feltzing changed the CURLOPT_FTP_SSL_CCC option to handle - active and passive CCC shutdown and added the --ftp-ssl-ccc-mode command - line option. - -Daniel (19 February 2007) -- Ian Turner fixed the libcurl.m4 macro's support for --with-libcurl. - -- Shmulik Regev found a memory leak in re-used HTTPS connections, at least - when the multi interface was used. - -- Robson Braga Araujo made passive FTP transfers work with SOCKS (both 4 and - 5). - -Daniel (18 February 2007) -- Jeff Pohlmeyer identified two problems: first a rather obscure problem with - the multi interface and connection re-use that could make a - curl_multi_remove_handle() ruin a pointer in another handle. - - The second problem was less of an actual problem but more of minor quirk: - the re-using of connections wasn't properly checking if the connection was - marked for closure. - -Daniel (16 February 2007) -- Duncan Mac-Vicar Prett and Michal Marek reported problems with resetting - CURLOPT_RANGE back to no range on an easy handle when using FTP. - -Dan F (14 February 2007) -- Fixed curl-config --libs so it doesn't list unnecessary libraries (and - therefore introduce unnecessary dependencies) when it's not needed. - Also, don't bother adding a library path of /usr/lib - -Daniel (13 February 2007) -- The default password for anonymous FTP connections is now changed to be - "ftp@example.com". - -- Robert A. Monat made libcurl build fine with VC2005 - it doesn't have - gmtime_r() like the older VC versions. He also made use of some machine- - specific defines to differentiate the "OS" define. - -Daniel (12 February 2007) -- Rob Crittenden added support for NSS (Network Security Service) for the - SSL/TLS layer. https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS - - This is the fourth supported library for TLS/SSL that libcurl supports! - -- Shmulik Regev fixed so that the final CRLF of HTTP response headers are sent - to the debug callback. - -- Shmulik Regev added CURLOPT_HTTP_CONTENT_DECODING and - CURLOPT_HTTP_TRANSFER_DECODING that if set to zero will disable libcurl's - internal decoding of content or transfer encoded content. This may be - preferable in cases where you use libcurl for proxy purposes or similar. The - command line tool got a --raw option to disable both at once. - -- release tarballs made with maketgz will from now on have a LIBCURL_TIMESTAMP - define set to hold the exact date and time of when the tarball was built, as - a human readable string using the UTC time zone. - -- Jeff Pohlmeyer fixed a flaw in curl_multi_add_handle() when adding a handle - that has an easy handle present in the "closure" list pending closure. - -Daniel (6 February 2007) -- Regular file downloads wiht SFTP and SCP are now done using the non-blocking - API of libssh2, if the libssh2 headers seem to support them. This will make - SCP and SFTP much more responsive and better libcurl citizens when used with - the multi interface etc. - -Daniel (5 February 2007) -- Michael Wallner added support for CURLOPT_TIMEOUT_MS and - CURLOPT_CONNECTTIMEOUT_MS that, as their names suggest, do the timeouts with - millisecond resolution. The only restriction to that is the alarm() - (sometimes) used to abort name resolves as that uses full seconds. I fixed - the FTP response timeout part of the patch. - - Internally we now count and keep the timeouts in milliseconds but it also - means we multiply set timeouts with 1000. The effect of this is that no - timeout can be set to more than 2^31 milliseconds (on 32 bit systems), which - equals 24.86 days. We probably couldn't before either since the code did - *1000 on the timeout values on several places already. - -Daniel (3 February 2007) -- Yang Tse fixed the cookie expiry date in several test cases that started to - fail since they used "1 feb 2007"... - -- Manfred Schwarb reported that socks5 support was broken and help us pinpoint - the problem. The code now tries harder to use httproxy and proxy where - apppropriate, as not all proxies are HTTP... - -Version 7.16.1 (29 January 2007) - -Daniel (29 January 2007) -- Michael Wallner reported that when doing a CONNECT with a custom User-Agent - header, you got _two_ User-Agent headers in the CONNECT request...! Added - test case 287 to verify the fix. - -Daniel (28 January 2007) -- curl_easy_reset() now resets the CA bundle path correctly. - -- David McCreedy fixed the Curl command line tool for HTTP on non-ASCII - platforms. - -Daniel (25 January 2007) -- Added the --libcurl [file] option to curl. Append this option to any - ordinary curl command line, and you will get a libcurl-using source code - written to the file that does the equivalent operation of what your command - line operation does! - -Dan F (24 January 2007) -- Fixed a dangling pointer problem that prevented the http_proxy environment - variable from being properly used in many cases (and caused test case 63 - to fail). - -Daniel (23 January 2007) -- David McCreedy did NTLM changes mainly for non-ASCII platforms: - - #1 - There's a compilation error in http_ntlm.c if USE_NTLM2SESSION is NOT - defined. I noticed this while testing various configurations. Line 867 of - the current http_ntlm.c is a closing bracket for an if/else pair that only - gets compiled in if USE_NTLM2SESSION is defined. But this closing bracket - wasn't in an #ifdef so the code fails to compile unless USE_NTLM2SESSION was - defined. Lines 198 and 140 of my patch wraps that closing bracket in an - #ifdef USE_NTLM2SESSION. - - #2 - I noticed several picky compiler warnings when DEBUG_ME is defined. I've - fixed them with casting. By the way, DEBUG_ME was a huge help in - understanding this code. - - #3 - Hopefully the last non-ASCII conversion patch for libcurl in a while. I - changed the "NTLMSSP" literal to hex since this signature must always be in - ASCII. - - Conversion code was strategically added where necessary. And the - Curl_base64_encode calls were changed so the binary "blobs" http_ntlm.c - creates are NOT translated on non-ASCII platforms. - -Dan F (22 January 2007) -- Converted (most of) the test data files into genuine XML. A handful still - are not, due mainly to the lack of support for XML character entities - (e.g. & => & ). This will make it easier to validate test files using - tools like xmllint, as well as to edit and view them using XML tools. - -Daniel (16 January 2007) -- Armel Asselin improved libcurl to behave a lot better when an easy handle - doing an FTP transfer is removed from a multi handle before completion. The - fix also fixed the "alive counter" to be correct on "premature removal" for - all protocols. - -Dan F (16 January 2007) -- Fixed a small memory leak in tftp uploads discovered by curl's memory leak - detector. Also changed tftp downloads to URL-unescape the downloaded - file name. - -Daniel (14 January 2007) -- David McCreedy provided libcurl changes for doing HTTP communication on - non-ASCII platforms. It does add some complexity, most notably with more - #ifdefs, but I want to see this supported added and I can't see how we can - add it without the extra stuff added. - -- Setting CURLOPT_COOKIELIST to "ALL" when no cookies at all was present, - libcurl would crash when trying to read a NULL pointer. - -Daniel (12 January 2007) -- Toby Peterson found a nasty bug that prevented (lib)curl from properly - downloading (most) things that were larger than 4GB on 32 bit systems. Matt - Witherspoon helped as narrow down the problem. - -Daniel (5 January 2007) -- Linus Nielsen Feltzing introduced the --ftp-ssl-ccc command line option to - curl that uses the new CURLOPT_FTP_SSL_CCC option in libcurl. If enabled, it - will make libcurl shutdown SSL/TLS after the authentication is done on a - FTP-SSL operation. - -Daniel (4 January 2007) -- David McCreedy made changes to allow base64 encoding/decoding to work on - non-ASCII platforms. - -Daniel (3 January 2007) -- Matt Witherspoon fixed the flaw which made libcurl 7.16.0 always store - downloaded data in two buffers, just to be able to deal with a special HTTP - pipelining case. That is now only activated for pipelined transfers. In - Matt's case, it showed as a considerable performance difference, - -Daniel (2 January 2007) -- Victor Snezhko helped us fix bug report #1603712 - (https://curl.haxx.se/bug/view.cgi?id=1603712) (known bug #36) --limit-rate - (CURLOPT_MAX_SEND_SPEED_LARGE and CURLOPT_MAX_RECV_SPEED_LARGE) are broken - on Windows (since 7.16.0, but that's when they were introduced as previous - to that the limiting logic was made in the application only and not in the - library). It was actually also broken on select()-based systems (as apposed - to poll()) but we haven't had any such reports. We now use select(), Sleep() - or delay() properly to sleep a while without waiting for anything input or - output when the rate limiting is activated with the easy interface. - -- Modified libcurl.pc.in to use Libs.private for the libs libcurl itself needs - to get built static. It has been mentioned before and was again brought to - our attention by Nathanael Nerode who filed debian bug report #405226 - (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=405226). - -Daniel (29 December 2006) -- Make curl_easy_duphandle() set the magic number in the new handle. - -Daniel (22 December 2006) -- Robert Foreman provided a prime example snippet showing how libcurl would - get confused and not acknowledge the 'no_proxy' variable properly once it - had used the proxy and you re-used the same easy handle. I made sure the - proxy name is properly stored in the connect struct rather than the - sessionhandle/easy struct. - -- David McCreedy fixed a bad call to getsockname() that wrongly used a size_t - variable to point to when it should be a socklen_t. - -- When setting a proxy with environment variables and (for example) running - 'curl [URL]' with a URL without a protocol prefix, curl would not send a - correct request as it failed to add the protocol prefix. - -Daniel (21 December 2006) -- Robson Braga Araujo reported bug #1618359 - (https://curl.haxx.se/bug/view.cgi?id=1618359) and subsequently provided a - patch for it: when downloading 2 zero byte files in a row, curl 7.16.0 - enters an infinite loop, while curl 7.16.1-20061218 does one additional - unnecessary request. - - Fix: During the "Major overhaul introducing http pipelining support and - shared connection cache within the multi handle." change, headerbytecount - was moved to live in the Curl_transfer_keeper structure. But that structure - is reset in the Transfer method, losing the information that we had about - the header size. This patch moves it back to the connectdata struct. - -Daniel (16 December 2006) -- Brendan Jurd provided a fix that now prevents libcurl from getting a SIGPIPE - during certain conditions when GnuTLS is used. - -Daniel (11 December 2006) -- Alexey Simak found out that when doing FTP with the multi interface and - something went wrong like it got a bad response code back from the server, - libcurl would leak memory. Added test case 538 to verify the fix. - - I also noted that the connection would get cached in that case, which - doesn't make sense since it cannot be re-use when the authentication has - failed. I fixed that issue too at the same time, and also that the path - would be "remembered" in vain for cases where the connection was about to - get closed. - -Daniel (6 December 2006) -- Sebastien Willemijns reported bug #1603712 - (https://curl.haxx.se/bug/view.cgi?id=1603712) which is about connections - getting cut off prematurely when --limit-rate is used. While I found no such - problems in my tests nor in my reading of the code, I found that the - --limit-rate code was severly flawed (since it was moved into the lib, since - 7.15.5) when used with the easy interface and it didn't work as documented - so I reworked it somewhat and now it works for my tests. - -Daniel (5 December 2006) -- Stefan Krause pointed out a compiler warning with a picky MSCV compiler when - passing a curl_off_t argument to the Curl_read_rewind() function which takes - an size_t argument. Curl_read_rewind() also had debug code left in it and it - was put in a different source file with no good reason when only used from - one single spot. - -- Sh Diao reported that CURLOPT_CLOSEPOLICY doesn't work, and indeed, there is - no code present in the library that receives the option. Since it was not - possible to use, we know that no current users exist and thus we simply - removed it from the docs and made the code always use the default path of - the code. - -- Jared Lundell filed bug report #1604956 - (https://curl.haxx.se/bug/view.cgi?id=1604956) which identified setting - CURLOPT_MAXCONNECTS to zero caused libcurl to SIGSEGV. Starting now, libcurl - will always internally use no less than 1 entry in the connection cache. - -- Sh Diao reported that CURLOPT_FORBID_REUSE no works, and indeed it broke in - the 7.16.0 release. - -- Martin Skinner brought back bug report #1230118 to haunt us once again. - (https://curl.haxx.se/bug/view.cgi?id=1230118) curl_getdate() did not work - properly for all input dates on Windows. It was mostly seen on some TZ time - zones using DST. Luckily, Martin also provided a fix. - -- Alexey Simak filed bug report #1600447 - (https://curl.haxx.se/bug/view.cgi?id=1600447) in which he noted that active - FTP connections don't work with the multi interface. The problem is here - that the multi interface state machine has a state during which it can wait - for the data connection to connect, but the active connection is not done in - the same step in the sequence as the passive one is so it doesn't quite work - for active. The active FTP code still use a blocking function to allow the - remote server to connect. - - The fix (work-around is a better word) for this problem is to set the - boolean prematurely that the data connection is completed, so that the "wait - for connect" phase ends at once. - - The proper fix, left for the future, is of course to make the active FTP - case to act in a non-blocking way too. - -- Matt Witherspoon fixed a problem case when the CPU load went to 100% when a - HTTP upload was disconnected: - - "What appears to be happening is that my system (Linux 2.6.17 and 2.6.13) is - setting *only* POLLHUP on poll() when the conditions in my previous mail - occur. As you can see, select.c:Curl_select() does not check for POLLHUP. So - basically what was happening, is poll() was returning immediately (with - POLLHUP set), but when Curl_select() looked at the bits, neither POLLERR or - POLLOUT was set. This still caused Curl_readwrite() to be called, which - quickly returned. Then the transfer() loop kept continuing at full speed - forever." - -Daniel (1 December 2006) -- Toon Verwaest reported that there are servers that send the Content-Range: - header in a third, not suppported by libcurl, format and we agreed that we - could make the parser more forgiving to accept all the three found - variations. - -Daniel (25 November 2006) -- Venkat Akella found out that libcurl did not like HTTP responses that simply - responded with a single status line and no headers nor body. Starting now, a - HTTP response on a persistent connection (i.e not set to be closed after the - response has been taken care of) must have Content-Length or chunked - encoding set, or libcurl will simply assume that there is no body. - - To my horror I learned that we had no less than 57(!) test cases that did bad - HTTP responses like this, and even the test http server (sws) responded badly - when queried by the test system if it is the test system. So although the - actual fix for the problem was tiny, going through all the newly failing test - cases got really painful and boring. - -Daniel (24 November 2006) -- James Housley did lots of work and introduced SFTP downloads. - -Daniel (13 November 2006) -- Ron in bug #1595348 (https://curl.haxx.se/bug/view.cgi?id=1595348) pointed - out a stack overwrite (and the corresponding fix) on 64bit Windows when - dealing with HTTP chunked encoding. - -Daniel (9 November 2006) -- Nir Soffer updated libcurl.framework.make: - o fix symlinks, should link to Versions, not to ./Versions - o indentation improvments - -- Dmitriy Sergeyev found a SIGSEGV with his test04.c example posted on 7 Nov - 2006. It turned out we wrongly assumed that the connection cache was present - when tearing down a connection. - -- Ciprian Badescu found a SIGSEGV when doing multiple TFTP transfers using the - multi interface, but I could also repeat it doing multiple sequential ones - with the easy interface. Using Ciprian's test case, I could fix it. - -Daniel (8 November 2006) -- Bradford Bruce reported that when setting CURLOPT_DEBUGFUNCTION without - CURLOPT_VERBOSE set to non-zero, you still got a few debug messages from the - SSL handshake. This is now stopped. - -Daniel (7 November 2006) -- Olaf fixed a leftover problem with the CONNECT fix of his that would leave a - wrong error message in the error message buffer. - -Daniel (3 November 2006) -- Olaf Stueben provided a patch that I edited slightly. It fixes the notorious - KNOWN_BUGS #25, which happens when a proxy closes the connection when - libcurl has sent CONNECT, as part of an authentication negotiation. Starting - now, libcurl will re-connect accordingly and continue the authentication as - it should. - -Daniel (2 November 2006) -- James Housley brought support for SCP transfers, based on the libssh2 library - for the actual network protocol stuff. - - Added these new curl_easy_setopt() options: - - CURLOPT_SSH_AUTH_TYPES - CURLOPT_SSH_PUBLIC_KEYFILE - CURLOPT_SSH_PRIVATE_KEYFILE - -Version 7.16.0 (30 October 2006) - -Daniel (25 October 2006) -- Fixed CURLOPT_FAILONERROR to return CURLE_HTTP_RETURNED_ERROR even for the - case when 401 or 407 are returned, *IF* no auth credentials have been given. - The CURLOPT_FAILONERROR option is not possible to make fool-proof for 401 - and 407 cases when auth credentials is given, but we've now covered this - somewhat more. - - You might get some amounts of headers transferred before this situation is - detected, like for when a "100-continue" is received as a response to a - POST/PUT and a 401 or 407 is received immediately afterwards. - - Added test 281 to verify this change. - -Daniel (23 October 2006) -- Ravi Pratap provided a major update with pipelining fixes. We also no longer - re-use connections (for pipelining) before the name resolving is done. - -Daniel (21 October 2006) -- Nir Soffer made the tests/libtest/Makefile.am use a proper variable for all - the single test applications' link and dependences, so that you easier can - override those from the command line when using make. - -- Armel Asselin separated CA cert verification problems from problems with - reading the (local) CA cert file to let users easier pinpoint the actual - problem. CURLE_SSL_CACERT_BADFILE (77) is the new libcurl error code. - -Daniel (18 October 2006) -- Removed the "protocol-guessing" for URLs with host names starting with FTPS - or TELNET since they are practically non-existant. This leaves us with only - three different prefixes that would assume the protocol is anything but - HTTP, and they are host names starting with "ftp.", "dict." or "ldap.". - -Daniel (17 October 2006) -- Bug report #1579171 pointed out code flaws detected with "prefast", and they - were 1 - a too small memory clear with memset() in the threaded resolver and - 2 - a range of potentially bad uses of the ctype family of is*() functions - such as isdigit(), isalnum(), isprint() and more. The latter made me switch - to using our own set of these functions/macros using uppercase letters, and - with some extra set of crazy typecasts to avoid mistakingly passing in - negative numbers to the underlying is*() functions. - -- With Jeff Pohlmeyer's help, I fixed the expire timer when using - curl_multi_socket() during name resolves with c-ares and the LOW_SPEED - options now work fine with curl_multi_socket() as well. - -Daniel (16 October 2006) -- Added a check in configure that simply tries to run a program (not when - cross-compiling) in order to detect problems with run-time libraries that - otherwise would occur when the sizeof tests for curl_off_t would run and - thus be much more confusing to users. The check of course should run after - all lib-checks are done and before any other test is used that would run an - executable built for testing-purposes. - -Dan F (13 October 2006) -- The tagging of application/x-www-form-urlencoded POST body data sent - to the CURLOPT_DEBUGFUNCTION callback has been fixed (it was erroneously - included as part of the header). A message was also added to the - command line tool to show when data is being sent, enabled when - --verbose is used. - -Daniel (12 October 2006) -- Starting now, adding an easy handle to a multi stack that was already added - to a multi stack will cause CURLM_BAD_EASY_HANDLE to get returned. - -- Jeff Pohlmeyer has been working with the hiperfifo.c example source code, - and while doing so it became apparent that the current timeout system for - the socket API really was a bit awkward since it become quite some work to - be sure we have the correct timeout set. - - Jeff then provided the new CURLMOPT_TIMERFUNCTION that is yet another - callback the app can set to get to know when the general timeout time - changes and thus for an application like hiperfifo.c it makes everything a - lot easier and nicer. There's a CURLMOPT_TIMERDATA option too of course in - good old libcurl tradition. - - Jeff has also updated the hiperfifo.c example code to use this news. - -Daniel (9 October 2006) -- Bogdan Nicula's second test case (posted Sun, 08 Oct 2006) converted to test - case 535 and it now runs fine. Again a problem with the pipelining code not - taking all possible (error) conditions into account. - -Daniel (6 October 2006) -- Bogdan Nicula's hanging test case (posted Wed, 04 Oct 2006) was converted to - test case 533 and the test now runs fine. - -Daniel (4 October 2006) -- Dmitriy Sergeyev provided an example source code that crashed CVS libcurl - but that worked nicely in 7.15.5. I converted it into test case 532 and - fixed the problem. - -Daniel (29 September 2006) -- Removed a few other no-longer present options from the header file. - -- Support for FTP third party transfers was removed. Here's why: - - o The recent multi interface changes broke it and the design of the 3rd party - transfers made it very hard to fix the problems - o It was still blocking and thus nasty for the multi interface - o It was a lot of extra code for a very rarely used feature - o It didn't use the same code as for "plain" FTP transfers, so it didn't work - fine for IPv6 and it didn't properly re-use connections and more - o There's nobody around who's willing to work on and improve the existing - code - - This does not mean that third party transfers are banned forever, only that - they need to be done better if they are to be re-added in the future. - - The CURLOPT_SOURCE_* options are removed from the lib and so are the --3p* - options from the command line tool. For this reason, I also bumped the - version info for the lib. - -Daniel (28 September 2006) -- Reported in #1561470 (https://curl.haxx.se/bug/view.cgi?id=1561470), libcurl - would crash if a bad function sequence was used when shutting down after - using the multi interface (i.e using easy_cleanup after multi_cleanup) so - precautions have been added to make sure it doesn't any more - test case 529 - was added to verify. - -Daniel (27 September 2006) -- The URL in the cookie jar file is now changed since it was giving a 404. - Reported by Timothy Stone. The new URL will take the visitor to a curl web - site mirror with the document. - -Daniel (24 September 2006) -- Bernard Leak fixed configure --with-gssapi-libs. - -- Cory Nelson made libcurl use the WSAPoll() function if built for Windows - Vista (_WIN32_WINNT >= 0x0600) - -Daniel (23 September 2006) -- Mike Protts added --ftp-ssl-control to make curl use FTP-SSL, but only - encrypt the control connection and use the data connection "plain". - -- Dmitriy Sergeyev provided a patch that made the SOCKS[45] code work better - as it now will read the full data sent from servers. The SOCKS-related code - was also moved to the new lib/socks.c source file. - -Daniel (21 September 2006) -- Added test case 531 in an attempt to repeat bug report #1561470 - (https://curl.haxx.se/bug/view.cgi?id=1561470) that is said to crash when an - FTP upload fails with the multi interface. It did not, but I made a failed - upload still assume the control connection to be fine. - -Daniel (20 September 2006) -- Armel Asselin fixed problems when you gave a proxy URL with user name and - empty password or no password at all. Test case 278 and 279 were added to - verify. - -Daniel (12 September 2006) -- Added docs/examples/10-at-a-time.c by Michael Wallner - -- Added docs/examples/hiperfifo.c by Jeff Pohlmeyer - -Daniel (11 September 2006) -- Fixed my breakage from earlier today so that doing curl_easy_cleanup() on a - handle that is part of a multi handle first removes the handle from the - stack. - -- Added CURLOPT_SSL_SESSIONID_CACHE and --no-sessionid to disable SSL - session-ID re-use on demand since there obviously are broken servers out - there that misbehave with session-IDs used. - -- Jeff Pohlmeyer presented a *multi_socket()-using program that exposed a - problem with it (SIGSEGV-style). It clearly showed that the existing - socket-state and state-difference function wasn't good enough so I rewrote - it and could then re-run Jeff's program without any crash. The previous - version clearly could miss to tell the application when a handle changed - from using one socket to using another. - - While I was at it (as I could use this as a means to track this problem - down), I've now added a 'magic' number to the easy handle struct that is - inited at curl_easy_init() time and cleared at curl_easy_cleanup() time that - we can use internally to detect that an easy handle seems to be fine, or at - least not closed or freed (freeing in debug builds fill the area with 0x13 - bytes but in normal builds we can of course not assume any particular data - in the freed areas). - -Daniel (9 September 2006) -- Michele Bini fixed how the hostname is put in NTLM packages. As servers - don't expect fully qualified names we need to cut them off at the first dot. - -- Peter Sylvester cleaned up and fixed the getsockname() uses in ftp.c. Some - of them can be completetly removed though... - -Daniel (6 September 2006) -- Ravi Pratap and I have implemented HTTP Pipelining support. Enable it for a - multi handle using CURLMOPT_PIPELINING and all HTTP connections done on that - handle will be attempted to get pipelined instead of done in parallell as - they are performed otherwise. - - As a side-effect from this work, connections are now shared between all easy - handles within a multi handle, so if you use N easy handles for transfers, - each of them can pick up and re-use a connection that was previously used by - any of the handles, be it the same or one of the others. - - This separation of the tight relationship between connections and easy - handles is most noticable when you close easy handles that have been used in - a multi handle and check amount of used memory or watch the debug output, as - there are times when libcurl will keep the easy handle around for a while - longer to be able to close it properly. Like for sending QUIT to close down - an FTP connection. - - This is a major change. - -Daniel (4 September 2006) -- Dmitry Rechkin (https://curl.haxx.se/bug/view.cgi?id=1551412) provided a - patch that while not fixing things very nicely, it does make the SOCKS5 - proxy connection slightly better as it now acknowledges the timeout for - connection and it no longer segfaults in the case when SOCKS requires - authentication and you did not specify username:password. - -Daniel (31 August 2006) -- Dmitriy Sergeyev found and fixed a multi interface flaw when using asynch - name resolves. It could get stuck in the wrong state. - -Gisle (29 August 2006) -- Added support for other MS-DOS compilers (desides djgpp). All MS-DOS - compiler now uses the same config.dos file (renamed to config.h by - make). libcurl now builds fine using Watcom and Metaware's High-C - using the Watt-32 tcp/ip-stack. - -Daniel (29 August 2006) -- David McCreedy added CURLOPT_SOCKOPTFUNCTION and CURLOPT_SOCKOPTDATA to - allow applications to set their own socket options. - -Daniel (25 August 2006) -- Armel Asselin reported that the 'running_handles' counter wasn't updated - properly if you removed a "live" handle from a multi handle with - curl_multi_remove_handle(). - -Daniel (22 August 2006) -- David McCreedy fixed a remaining mistake from the August 19 TYPE change. - -- Peter Sylvester pointed out a flaw in the AllowServerConnect() in the FTP - code when doing pure IPv6 EPRT connections. - -Daniel (19 August 2006) -- Based on a patch by Armel Asselin, the FTP code no longer re-issues the TYPE - command on subsequent requests on a re-used connection unless it has to. - -- Armel Asselin fixed a crash in the FTP code when using SINGLECWD mode and - files in the root directory. - -- Andrew Biggs pointed out a "Expect: 100-continue" flaw where libcurl didn't - send the whole request at once, even though the Expect: header was disabled - by the application. An effect of this change is also that small (< 1024 - bytes) POSTs are now always sent without Expect: header since we deem it - more costly to bother about that than the risk that we send the data in - vain. - -Daniel (9 August 2006) -- Armel Asselin made the CURLOPT_PREQUOTE option work fine even when - CURLOPT_NOBODY is set true. PREQUOTE is then run roughly at the same place - in the command sequence as it would have run if there would've been a - transfer. - -Daniel (8 August 2006) -- Fixed a flaw in the "Expect: 100-continue" treatment. If you did two POSTs - on a persistent connection and allowed the first to use that header, you - could not disable it for the second request. - -Daniel (7 August 2006) -- Domenico Andreolfound a quick build error which happened because - src/config.h.in was not a proper duplcate of lib/config.h.in which it - should've been and this was due to the maketgz script not doing the cp - properly. - -Version 7.15.5 (7 August 2006) - -Daniel (2 August 2006) -- Mark Lentczner fixed how libcurl was not properly doing chunked encoding - if the header "Transfer-Encoding: chunked" was set by the application. - https://curl.haxx.se/bug/view.cgi?id=1531838 - -Daniel (1 August 2006) -- Maciej Karpiuk fixed a crash that would occur if we passed Curl_strerror() - an unknown error number on glibc systems. - https://curl.haxx.se/bug/view.cgi?id=1532289 - -Daniel (31 July 2006) -- *ALERT* curl_multi_socket() and curl_multi_socket_all() got modified - prototypes: they both now provide the number of running handles back to the - calling function. It makes the functions resemble the good old - curl_multi_perform() more and provides a nice way to know when the multi - handle goes empty. - - ALERT2: don't use the curl_multi_socket*() functionality in anything - production-like until I say it's somewhat settled, as I suspect there might - be some further API changes before I'm done... - -Daniel (28 July 2006) -- Yves Lejeune fixed so that replacing Content-Type: when doing multipart - formposts work exactly the way you want it (and the way you'd assume it - works). - -Daniel (27 July 2006) -- David McCreedy added --ftp-ssl-reqd which makes curl *require* SSL for both - control and data connection, as the existing --ftp-ssl option only requests - it. - -- [Hiper-related work] Added a function called curl_multi_assign() that will - set a private pointer added to the internal libcurl hash table for the - particular socket passed in to this function: - - CURLMcode curl_multi_assign(CURLM *multi_handle, - curl_socket_t sockfd, - void *sockp); - - 'sockp' being a custom pointer set by the application to be associated with - this socket. The socket has to be already existing and in-use by libcurl, - like having already called the callback telling about its existance. - - The set hashp pointer will then be passed on to the callback in upcoming - calls when this same socket is used (in the brand new 'socketp' argument). - -Daniel (26 July 2006) -- Dan Nelson added the CURLOPT_FTP_ALTERNATIVE_TO_USER libcurl option and curl - tool option named --ftp-alternative-to-user. It provides a mean to send a - particular command if the normal USER/PASS approach fails. - -- Michael Jerris added magic that builds lib/curllib.vcproj automatically for - newer MSVC. - -Daniel (25 July 2006) -- Georg Horn made the transfer timeout error message include more details. - -Daniel (20 July 2006) -- David McCreedy fixed a build error when building libcurl with HTTP disabled, - problem added with the curl_formget() patch. - -Daniel (17 July 2006) -- Jari Sundell did some excellent research and bug tracking, figured out that - we did wrong and patched it: When nodes were removed from the splay tree, - and we didn't properly remove it from the splay tree when an easy handle was - removed from a multi stack and thus we could wrongly leave a node in the - splay tree pointing to (bad) memory. - -Daniel (14 July 2006) -- David McCreedy fixed a flaw where the CRLF counter wasn't properly cleared - for FTP ASCII transfers. - -Daniel (8 July 2006) -- Ates Goral pointed out that libcurl's cookie parser did case insensitive - string comparisons on the path which is incorrect and provided a patch that - fixes this. I edited test case 8 to include details that test for this. - -- Ingmar Runge provided a source snippet that caused a crash. The reason for - the crash was that libcurl internally was a bit confused about who owned the - DNS cache at all times so if you created an easy handle that uses a shared - DNS cache and added that to a multi handle it would crash. Now we keep more - careful internal track of exactly what kind of DNS cache each easy handle - uses: None, Private (allocated for and used only by this single handle), - Shared (points to a cache held by a shared object), Global (points to the - global cache) or Multi (points to the cache within the multi handle that is - automatically shared between all easy handles that are added with private - caches). - -Daniel (4 July 2006) -- Toshiyuki Maezawa fixed a problem where you couldn't override the - Proxy-Connection: header when using a proxy and not doing CONNECT. - -Daniel (24 June 2006) -- Michael Wallner added curl_formget(), which allows an application to extract - (serialise) a previously built formpost (as with curl_formadd()). - -Daniel (23 June 2006) -- Arve Knudsen found a flaw in curl_multi_fdset() for systems where - curl_socket_t is unsigned (like Windows) that could cause it to wrongly - return a max fd of -1. - -Daniel (20 June 2006) -- Peter Silva introduced CURLOPT_MAX_SEND_SPEED_LARGE and - CURLOPT_MAX_RECV_SPEED_LARGE that limit tha maximum rate libcurl is allowed - to send or receive data. This kind of adds the the command line tool's - option --limit-rate to the library. - - The rate limiting logic in the curl app is now removed and is instead - provided by libcurl itself. Transfer rate limiting will now also work for -d - and -F, which it didn't before. - -Daniel (19 June 2006) -- Made -K on a file that couldn't be read cause a warning to be displayed. - -Daniel (13 June 2006) -- Dan Fandrich implemented --enable-hidden-symbols configure option to enable - -fvisibility=hidden on gcc >= 4.0. This reduces the size of the libcurl - binary and speeds up dynamic linking by hiding all the internal symbols from - the symbol table. - -Version 7.15.4 (12 June 2006) - -Daniel (8 June 2006) -- Brian Dessent fixed the code for cygwin in three distinct ways: - - The first modifies {lib,src}/setup.h to not include the winsock headers - under Cygwin. This fixes the reported build problem. Cygwin attempts as - much as possible to emulate a posix environment under Windows. This means - that WIN32 is *not* #defined and (to the extent possible) everything is done - as it would be on a *ix type system. Thus <sys/socket.h> is the proper - include, and even though winsock2.h is present, including it just introduces - a whole bunch of incompatible socket API stuff. - - The second is a patch I've included in the Cygwin binary packages for a - while. It skips two unnecessary library checks (-lwinmm and -lgdi32). The - checks are innocuous and they do succeed, but they pollute LIBS with - unnecessary stuff which gets recorded as such in the libcurl.la file, which - brings them into the build of any libcurl-downstream. As far as I know - these libs are really only necessary for mingw, so alternatively they could - be designed to only run if $host matches *-*-mingw* but I took the safer - route of skipping them for *-*-cygwin*. - - The third patch replaces all uses of the ancient and obsolete __CYGWIN32__ - with __CYGWIN__. Ref: <https://cygwin.com/ml/cygwin/2003-09/msg01520.html>. - -Daniel (7 June 2006) -- Mikael Sennerholm provided a patch that added NTLM2 session response support - to libcurl. The 21 NTLM test cases were again modified to comply... - -Daniel (27 May 2006) -- Óscar Morales Vivó updated the libcurl.framework.make file. - -Daniel (26 May 2006) -- Olaf Stüben fixed a bug that caused Digest authentication with md5-sess to - fail. When using the md5-sess, the result was not Md5 encoded and Base64 - transformed. - -Daniel (25 May 2006) -- Michael Wallner provided a patch that allows "SESS" to be set with - CURLOPT_COOKIELIST, which then makes all session cookies get cleared. - -Daniel (24 May 2006) -- Tor Arntsen made test 271 run fine again since the TFTP path fix. - -Daniel (23 May 2006) -- Martin Michlmayr filed debian bug report #367954, but the same error also - showed up in the autobuilds. It seems a rather long-since introduced shell - script flaw in the configure script suddenly was detected by the bash - version in Debian Unstable. It had previously passed undetected by all - shells used so far... - -- David McCreedy updated lib/config-tpf.h - -Daniel (11 May 2006) -- Fixed the configure's check for old-style SSLeay headers since I fell over a - case with a duplicate file name (a krb4 implementation with an err.h - file). I converted the check to manually make sure three of the headers are - present before considering them fine. - -- David McCreedy provided a fix for CURLINFO_LASTSOCKET that does extended - checks on the to-be-returned socket to make sure it truly seems to be alive - and well. For SSL connection it (only) uses OpenSSL functions. - -Daniel (10 May 2006) -- Fixed DICT in two aspects: - - 1 - allow properly URL-escaped words, like using %20 for spaces - - 2 - properly escape certain letters within a word to comply to the RFC2229 - -Daniel (9 May 2006) -- Andreas Ntaflos reported a bug in libcurl.m4: When configuring my GNU - autotools project, which optionally (default=yes) uses libcurl on a system - without a (usable) libcurl installation, but not specifying - `--without-libcurl', configure determines correctly that no libcurl is - available, however, the LIBCURL variable gets expanded to `LIBCURL = -lcurl' - in the resulting Makefiles. - - David Shaw fixed the flaw. - -- Robson Braga Araujo fixed two problems in the recently added non-blocking SSL - connects. The state machine was not reset properly so that subsequent - connects using the same handle would fail, and there were two memory leaks. - -- Robson Braga Araujo fixed a memory leak when you added an easy handle to a - multi stack and that easy handle had already been used to do one or more - easy interface transfers, as then the code threw away the previously used - DNS cache without properly freeing it. - -Daniel (8 May 2006) -- Dan Fandrich went over the TFTP code and he pointed out and fixed numerous - problems: - - * The received file is corrupted when a packet is lost and retransmitted - (this is a serious problem!) - - * Transmitting a file aborts if a block is lost and retransmitted - - * Data is stored in the wrong location in the buffer for uploads, so uploads - always fail (I don't see how it could have ever worked, but it did on x86 - at least) - - * A number of calls are made to strerror instead of Curl_strerror, making - the code not thread safe - - * There are references to errno instead of Curl_sockerrno(), causing - incorrect error messages on Windows - - * The file name includes a leading / which violates RFC3617. Doing something - similar to ftp, where two slashes after the host name means an absolute - reference seems a reasonable extension to fix this. - - * Failures in EBCDIC conversion are not propagated up to the caller but are - silently ignored - -- Fixed known bug #28. The TFTP code no longer assumes a packed struct and - thus works reliably on more platforms. - -Daniel (5 May 2006) -- Roland Blom filed bug report #1481217 - (https://curl.haxx.se/bug/view.cgi?id=1481217), with follow-ups by Michele - Bini and David Byron. libcurl previously wrongly used GetLastError() on - windows to get error details after socket-related function calls, when it - really should use WSAGetLastError() instead. - - When changing to this, the former function Curl_ourerrno() is now instead - called Curl_sockerrno() as it is necessary to only use it to get errno from - socket-related functions as otherwise it won't work as intended on Windows. - -Daniel (4 May 2006) -- Mark Eichin submitted bug report #1480821 - (https://curl.haxx.se/bug/view.cgi?id=1480821) He found and identified a - problem with how libcurl dealt with GnuTLS and a case where gnutls returned - GNUTLS_E_AGAIN indicating it would block. It would then return an unexpected - return code, making Curl_ssl_send() confuse the upper layer - causing random - 28 bytes trash data to get inserted in the transfered stream. - - The proper fix was to make the Curl_gtls_send() function return the proper - return codes that the callers would expect. The Curl_ossl_send() function - already did this. - -Daniel (2 May 2006) -- Added a --checkfor option to curl-config to allow users to easier - write for example shell scripts that test for the presence of a - new-enough libcurl version. If --checkfor is given a version string - newer than what is currently installed, curl-config will return a - non-zero exit code and output a string about the unfulfilled - requirement. - -Daniel (26 April 2006) -- David McCreedy brought initial line end conversions when doing FTP ASCII - transfers. They are done on non-windows systems and translate CRLF to LF. - - I modified the 15 LIST-using test cases accordingly. The downside is that now - we'll have even more trouble to get the tests to run on Windows since they - should get CRLF newlines left intact which the *nix versions don't. I figure - the only sane thing to do is to add some kind of [newline] macro for the test - case files and have them expanded to the proper native line ending when the - test cases are run. This is however left to implement. - -Daniel (25 April 2006) -- Paul Querna fixed libcurl to better deal with deflate content encoding - when the stream (wrongly) lacks a proper zlib header. This seems to be the - case on too many actual server implementations. - -Daniel (21 April 2006) -- Ale Vesely fixed CURLOPT_INTERFACE when using a hostname. - -Daniel (19 April 2006) -- Based on previous info from Tor Arntsen, I made configure detect the Intel - ICC compiler to add a compiler option for it, in order for configure to - properly be able to detect function prototypes. - -- Robson Braga Araujo provided a patch that makes libcurl less eager to close - the control connection when using FTP, for example when you remove an easy - handle from a multi stack. - -- Applied a patch by Ates Goral and Katie Wang that corrected my bad fix - attempt from April 10. - -Daniel (11 April 2006) -- #1468330 (https://curl.haxx.se/bug/view.cgi?id=1468330) pointed out a bad - typecast in the curl tool leading to a crash with (64bit?) VS2005 (at least) - since the struct timeval field tv_sec is an int while time_t is 64bit. - -Daniel (10 April 2006) -- Ates Goral found out that if you specified both CURLOPT_CONNECTTIMEOUT and - CURLOPT_TIMEOUT, the _longer_ time would wrongly be used for the SSL - connection time-out! - -- I merged my hiper patch (https://curl.haxx.se/libcurl/hiper/) into the main - sources. See the lib/README.multi_socket for implementation story with - details. Don't expect it to work fully yet. I don't intend to blow any - whistles or ring any bells about it until I'm more convinced it works at - least somewhat reliably. - -Daniel (7 April 2006) -- David McCreedy's EBCDIC and TPF changes. Three new curl_easy_setopt() - options (callbacks) were added: - - CONV_FROM_NETWORK_FUNCTION - CONV_TO_NETWORK_FUNCTION - CONV_FROM_UTF8_FUNCTION - -Daniel (5 April 2006) -- Michele Bini modified the NTLM code to work for his "weird IIS case" - (https://curl.haxx.se/mail/lib-2006-02/0154.html) by adding the NTLM hash - function in addition to the LM one and making some other adjustments in the - order the different parts of the data block are sent in the Type-2 reply. - Inspiration for this work was taken from the Firefox NTLM implementation. - - I edited the existing 21(!) NTLM test cases to run fine with these news. Due - to the fact that we now properly include the host name in the Type-2 message - the test cases now only compare parts of that chunk. - -Daniel (28 March 2006) -- #1451929 (https://curl.haxx.se/bug/view.cgi?id=1451929) detailed a bug that - occurred when asking libcurl to follow HTTP redirects and the original URL - had more than one question mark (?). Added test case 276 to verify. - -Daniel (27 March 2006) -- David Byron found a problem multiple -d options when libcurl was built with - --enable-debug, as then curl used free() on memory allocated both with - normal malloc() and with libcurl-provided functions, when the latter MUST be - freed with curl_free() in debug builds. - -Daniel (26 March 2006) -- Tor Arntsen figured out that TFTP was broken on a lot of systems since we - called bind() with a too big argument in the 3rd parameter and at least - Tru64, AIX and IRIX seem to be very picky about it. - -Daniel (21 March 2006) -- David McCreedy added CURLINFO_FTP_ENTRY_PATH. - -- Xavier Bouchoux made the SSL connection non-blocking for the multi interface - (when using OpenSSL). - -- Tor Arntsen fixed the AIX Toolbox RPM spec - -Daniel (20 March 2006) -- David McCreedy fixed libcurl to no longer ignore AUTH failures and now it - reacts properly according to the CURLOPT_FTP_SSL setting. - -- Dan Fandrich fixed two TFTP problems: Fixed a bug whereby a received file - whose length was a multiple of 512 bytes could have random garbage - appended. Also, stop processing TFTP packets which are too short to be - legal. - -- Ilja van Sprundel reported a possible crash in the curl tool when using - "curl hostwithoutslash -d data -G" - -Version 7.15.3 (20 March 2006) - -Daniel (20 March 2006) -- VULNERABILITY reported to us by Ulf Harnhammar. - - libcurl uses the given file part of a TFTP URL in a manner that allows a - malicious user to overflow a heap-based memory buffer due to the lack of - boundary check. - - This overflow happens if you pass in a URL with a TFTP protocol prefix - ("tftp://"), using a valid host and a path part that is longer than 512 - bytes. - - The affected flaw can be triggered by a redirect, if curl/libcurl is told to - follow redirects and an HTTP server points the client to a tftp URL with the - characteristics described above. - - The Common Vulnerabilities and Exposures (CVE) project has assigned the name - CVE-2006-1061 to this issue. - -Daniel (16 March 2006) -- Tor Arntsen provided a RPM spec file for AIX Toolbox, that now is included - in the release archive. - -Daniel (14 March 2006) -- David McCreedy fixed: - - a bad SSL error message when OpenSSL certificates are verified fine. - - a missing return code assignment in the FTP code - -Daniel (7 March 2006) -- Markus Koetter filed debian bug report #355715 which identified a problem - with the multi interface and multi-part formposts. The fix from February - 22nd could make the Curl_done() function get called twice on the same - connection and it was not designed for that and thus tried to call free() on - an already freed memory area! - -- Peter Heuchert made sure the CURLFTPSSL_CONTROL setting for CURLOPT_FTP_SSL - is used properly. - -Daniel (6 March 2006) -- Lots of users on Windows have reported getting the "SSL: couldn't set - callback" error message so I've now made the setting of that callback not be - as critical as before. The function is only used for additional loggging/ - trace anyway so a failure just means slightly less data. It should still be - able to proceed and connect fine to the server. - -Daniel (4 March 2006) -- Thomas Klausner provided a patch written by Todd Vierling in bug report - #1442471 that fixes a build problem on Interix. - -Daniel (2 March 2006) -- FTP upload without a file name part in the URL now causes - curl_easy_perform() to return CURLE_URL_MALFORMAT. Previously it allowed the - upload but named the file "(nil)" (without the quotes). Test case 524 - verifies. - -- Added a check for getprotobyname in configure so that it'll be used, thanks - to Gisle Vanem's change the other day. - -Daniel (28 February 2006) -- Dan Fandrich prevented curl from getting stuck in an endless loop in case we - are out of file handles very early in curl's code where it makes sure that - 0, 1 and 2 aren't gonna be used by the lib for transfers. - -Daniel (27 February 2006) -- Marty Kuhrt pointed out that there were two VMS-specific files missing in - the release archive. - -Version 7.15.2 (27 February 2006) - -Daniel (22 February 2006) -- Lots of work and analysis by "xbx___" in bug #1431750 - (https://curl.haxx.se/bug/view.cgi?id=1431750) helped me identify and fix two - different but related bugs: - - 1) Removing an easy handle from a multi handle before the transfer is done - could leave a connection in the connection cache for that handle that is - in a state that isn't suitable for re-use. A subsequent re-use could then - read from a NULL pointer and segfault. - - 2) When an easy handle was removed from the multi handle, there could be an - outstanding c-ares DNS name resolve request. When the response arrived, - it caused havoc since the connection struct it "belonged" to could've - been freed already. - - Now Curl_done() is called when an easy handle is removed from a multi handle - pre-maturely (that is, before the transfer was complteted). Curl_done() also - makes sure to cancel all (if any) outstanding c-ares requests. - -Daniel (21 February 2006) -- Peter Su added support for SOCKS4 proxies. Enable this by setting the proxy - type to the already provided type CURLPROXY_SOCKS4. - - I added a --socks4 option that works like the current --socks5 option but - instead use the socks4 protocol. - -Daniel (20 February 2006) -- Shmulik Regev fixed an issue with multi-pass authentication and compressed - content when libcurl didn't honor the internal ignorebody flag. - -Daniel (18 February 2006) -- Ulf Härnhammar fixed a format string (printf style) problem in the Negotiate - code. It should however not be the cause of any troubles. He also fixed a - few similar problems in the HTTP test server code. - -Daniel (17 February 2006) -- Shmulik Regev provided a fix for the DNS cache when using short life times, - as previously it could be holding on to old cached entries longer than - requested. - -Daniel (11 February 2006) -- Karl Moerder added the CURLOPT_CONNECT_ONLY and CURLINFO_LASTSOCKET options - that an app can use to let libcurl only connect to a remote host and then - extract the socket from libcurl. libcurl will then not attempt to do any - transfer at all after the connect is done. - -- Kent Boortz improved the configure check for GnuTLS to properly set LIBS - instead of LDFLAGS. - -Daniel (8 February 2006) -- Philippe Vaucher provided a brilliant piece of test code that show a problem - with re-used FTP connections. If the second request on the same connection - was set not to fetch a "body", libcurl could get confused and consider it an - attempt to use a dead connection and would go acting mighty strange. - -Daniel (2 February 2006) -- Make --limit-rate [num] mean bytes. It used to be that but it broke in my - change done in November 2005. - -Daniel (30 January 2006) -- Added CURLOPT_LOCALPORT and CURLOPT_LOCALPORTRANGE to libcurl. Set with the - curl tool with --local-port. Plain and simply set the range of ports to bind - the local end of connections to. Implemented on to popular demand. - -- Based on an error report by Philippe Vaucher, we no longer count a retried - connection setup as a follow-redirect. It turns out 1) this fails when a FTP - connection is re-setup and 2) it does make the max-redirs counter behave - wrong. - -Daniel (24 January 2006) -- Michal Marek provided a patch for FTP that makes libcurl continue to try - PASV even after EPSV returned a positive response code, if libcurl failed to - connect to the port number the EPSV response said. Obviously some people are - going through protocol-sensitive firewalls (or similar) that don't - understand EPSV and then they don't allow the second connection unless PASV - was used. This also called for a minor fix of test case 238. - -Daniel (20 January 2006) -- Duane Cathey was one of our friends who reported that curl -P [IP] - (CURLOPT_FTPPORT) didn't work for IPv6-enabed curls if the IP wasn't a - "native" IP while it works fine for IPv6-disabled builds! - - In the process of fixing this, I removed the support for LPRT since I can't - think of many reasons to keep doing it and asking on the mailing list didn't - reveal anyone else that could either. The code that sends EPRT and PORT is - now also a lot simpler than before (IMHO). - -Daniel (19 January 2006) -- Jon Turner pointed out that doing -P [hostname] (CURLOPT_FTPPORT) with curl - (built IPv4-only) didn't work. - -Daniel (18 January 2006) -- As reported in bug #1408742 (https://curl.haxx.se/bug/view.cgi?id=1408742), - the configure script complained about a missing "missing" script if you ran - configure within a path whose name included one or more spaces. This is due - to a flaw in automake (1.9.6 and earlier). I've now worked around it by - including an "overloaded" version of the AM_MISSING_HAS_RUN script that'll - be used instead of the one automake ships with. This kludge needs to be - removed once we get an automake version with this problem corrected. - Possibly we'll then need to convert this into a kludge depending on what - automake version that is used and that is gonna be painful and I don't even - want to think about that now...! - -Daniel (17 January 2006) -- David Shaw: Here is the latest libcurl.m4 autoconf tests. It is updated with - the latest features and protocols that libcurl supports and has a minor fix - to better deal with the obscure case where someone has more than one libcurl - installed at the same time. - -Daniel (16 January 2006) -- David Shaw finally removed all traces of Gopher and we are now officially - not supporting it. It hasn't been functioning for years anyway, so this is - just finally stating what already was true. And a cleanup at the same time. - -- Bryan Henderson turned the 'initialized' variable for curl_global_init() - into a counter, and thus you can now do multiple curl_global_init() and you - are then supposed to do the same amount of calls to curl_global_cleanup(). - Bryan has also updated the docs accordingly. - -Daniel (13 January 2006) -- Andrew Benham fixed a race condition in the test suite that could cause the - test script to kill all processes in the current process group! - -Daniel (12 January 2006) -- Michael Jahn: - - Fixed FTP_SKIP_PASV_IP and FTP_USE_EPSV to "do right" when used on FTP thru - HTTP proxy. - - Fixed PROXYTUNNEL to work fine when you do ftp through a proxy. It would - previously overwrite internal memory and cause unpredicted behaviour! - -Daniel (11 January 2006) -- I decided to document the "secret option" here now, as I've received *NO* - feedback at all on my mailing list requests from November 2005: - - I'm looking for feedback and comments. I added some experimental code the - other day, that allows a libcurl user to select what method libcurl should - use to reach a file on a FTP(S) server. - - This functionality is available in CVS code and in recent daily snapshots. - - Let me explain... - - The current name for the option is CURLOPT_FTP_FILEMETHOD (--ftp-method for - the command line tool) and you set it to a long (there are currenly no - defines for the argument values, just plain numericals). You can set three - different "methods" that do this: - - 1 multicwd - like today, curl will do a single CWD operation for each path - part in the given URL. For deep hierarchies this means very many - commands. This is how RFC1738 says it should be done. This is the - default. - - 2 nocwd - no CWD at all is done, curl will do SIZE, RETR, STOR etc and give - a full path to the server. - - 3 singlecwd - make one CWD with the full target directory and then operate - on the file "normally". - - (With the command line tool you do --ftp-method [METHOD], where [METHOD] is - one of "multicwd", "nocwd" or "singlecwd".) - - What feedback I'm interested in: - - 1 - Do they work at all? Do you find servers where one of these don't work? - - 2 - What would proper names for the option and its arguments be, if we - consider this feature good enough to get included and documented in - upcoming releases? - - 3 - Should we make libcurl able to "walk through" these options in case of - (path related) failures, or should it fail and let the user redo any - possible retries? - - (This option is not documented in any man page just yet since I'm not sure - these names will be used or if the functionality will end up exactly like - this. And for the same reasons we have no test cases for these yet.) - -Daniel (10 January 2006) -- When using a bad path over FTP, as in when libcurl couldn't CWD into all - given subdirs, libcurl would still "remember" the full path as if it is the - current directory libcurl is in so that the next curl_easy_perform() would - get really confused if it tried the same path again - as it would not issue - any CWD commands at all, assuming it is already in the "proper" dir. - - Starting now, a failed CWD command sets a flag that prevents the path to be - "remembered" after returning. - -Daniel (7 January 2006) -- Michael Jahn fixed so that the second CONNECT when doing FTP over a HTTP - proxy actually used a new connection and not sent the second request on the - first socket! - -Daniel (6 January 2006) -- Alexander Lazic made the buildconf run the buildconf in the ares dir if that - is present instead of trying to mimic that script in curl's buildconf - script. - -Daniel (3 January 2006) -- Andres Garcia made the TFTP test server build with mingw. -Daniel (16 December 2005) -- Jean Jacques Drouin pointed out that you could only have a user name or - password of 127 bytes or less embedded in a URL, where actually the code - uses a 255 byte buffer for it! Modified now to use the full buffer size. - -Daniel (12 December 2005) -- Dov Murik corrected the HTTP_ONLY define to disable the TFTP support properly - -Version 7.15.1 (7 December 2005) - -Daniel (6 December 2005) -- Full text here: https://curl.haxx.se/docs/adv_20051207.html Pointed out by - Stefan Esser. - - VULNERABILITY - - libcurl's URL parser function can overflow a malloced buffer in two ways, if - given a too long URL. - - These overflows happen if you - - 1 - pass in a URL with no protocol (like "http://") prefix, using no slash - and the string is 256 bytes or longer. This leads to a single zero byte - overflow of the malloced buffer. - - 2 - pass in a URL with only a question mark as separator (no slash) between - the host and the query part of the URL. This leads to a single zero byte - overflow of the malloced buffer. - - Both overflows can be made with the same input string, leading to two single - zero byte overwrites. - - The affected flaw cannot be triggered by a redirect, but the long URL must - be passed in "directly" to libcurl. It makes this a "local" problem. Of - course, lots of programs may still pass in user-provided URLs to libcurl - without doing much syntax checking of their own, allowing a user to exploit - this vulnerability. - - There is no known exploit at the time of this writing. - - -Daniel (2 December 2005) -- Jamie Newton pointed out that libcurl's file:// code would close() a zero - file descriptor if given a non-existing file. - -Daniel (24 November 2005) -- Doug Kaufman provided a set of patches to make curl build fine on DJGPP - again using configure. - -- Yang Tse provided a whole series of patches to clear up compiler warnings on - MSVC 6. - -Daniel (17 November 2005) -- I extended a patch from David Shaw to make libcurl _always_ provide an error - string in the given error buffer to address the flaw mention on 21 sep 2005. - -Daniel (16 November 2005) -- Applied Albert Chin's patch that makes the libcurl.pc pkgconfig file get - installed on 'make install' time. - -Daniel (14 November 2005) -- Quagmire reported that he needed to raise a NTLM buffer for SSPI to work - properly for a case, and so we did. We raised it even for non-SSPI builds - but it should not do any harm. https://curl.haxx.se/bug/view.cgi?id=1356715 - -- Jan Kunder's debian bug report - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=338680 identified a weird - error message for when you try to upload a file and the requested directory - doesn't exist on the target server. - -- Yang Tse fixed compiler warnings in lib/ssluse.c with OpenSSL 0.9.8 and in - lib/memdebug.h that showed up in his msvc builds. - -Daniel (13 November 2005) -- Debian bug report 338681 by Jan Kunder: make curl better detect and report - bad limit-rate units: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=338681 Now curl will return - error if a bad unit is used. - -- Thanks to this nice summary of poll() implementations: - http://www.greenend.org.uk/rjk/2001/06/poll.html and further tests by Eugene - Kotlyarov, we now know that cygwin's poll returns only POLLHUP on remote - connectin closure so we check for that case (too) and re-enable poll for - cygwin builds. - -Daniel (12 November 2005) -- Eugene Kotlyarov found out that cygwin's poll() function isn't doing things - right: https://curl.haxx.se/mail/archive-2005-11/0045.html so we now disable - poll() and use select() on cygwin too (we already do the same choice on Mac - OS X) - -- Dima Barsky patched problem #1348930: the GnuTLS code completely ignored - client certificates! (https://curl.haxx.se/bug/view.cgi?id=1348930). - -Daniel (10 November 2005) -- David Lang fixed IPv6 support for TFTP! - -- Introducing range stepping to the curl globbing support. Now you can specify - step counter by adding :[num] within the brackets when specifying a range: - - [1-100:10] - [a-z:2] - - If no step counter is set, it defaults to 1 as before: - - [1-100] - [d-h] - -Daniel (8 November 2005) -- Removed the use of AI_CANONNAME in the IPv6-enabled resolver functions since - we really have no use for reverse lookups of the address. - - I truly hope these are the last reverse lookups we had lingering in the - code! - -- Dmitry Bartsevich discovered some issues in compatibilty of SSPI-enabled - version of libcurl with different Windows versions. Current version of - libcurl imports SSPI functions from secur32.dll. However, under Windows NT - 4.0 these functions are located in security.dll, under Windows 9x - in - secur32.dll and Windows 2000 and XP contains both these DLLs (security.dll - just forwards calls to secur32.dll). - - Dmitry's patch loads proper library dynamically depending on Windows - version. Function InitSecurityInterface() is used to obtain pointers to all - of SSPI function in one structure. - -Daniel (31 October 2005) -- Vilmos Nebehaj improved libcurl's LDAP abilities: - - The LDAP code in libcurl can't handle LDAP servers of LDAPv3 nor binary - attributes in LDAP objects. So, I made a quick patch to address these - problems. - - The solution is simple: if we connect to an LDAP server, first try LDAPv3 - (which is the preferred protocol as of now) and then fall back to LDAPv2. - In case of binary attributes, we first convert them to base64, just like the - openldap client does. It uses ldap_get_values_len() instead of - ldap_get_values() to be able to retrieve binary attributes correctly. I - defined the necessary LDAP macros in lib/ldap.c to be able to compile - libcurl without the presence of libldap - -Daniel (27 October 2005) -- Nis Jorgensen filed bug report #1338648 - (https://curl.haxx.se/bug/view.cgi?id=1338648) which really is more of a - feature request, but anyway. It pointed out that --max-redirs did not allow - it to be set to 0, which then would return an error code on the first - Location: found. Based on Nis' patch, now libcurl supports CURLOPT_MAXREDIRS - set to 0, or -1 for infinity. Added test case 274 to verify. - -- tommink[at]post.pl reported in bug report #1337723 - (https://curl.haxx.se/bug/view.cgi?id=1337723) that curl could not upload - binary data from stdin on Windows if the data contained control-Z (hex 1a) - since that is treated as end-of-file when read in text mode. Gisle Vanem - pointed out the fix, and I made both -T and --data-binary take advantage of - it. - -- Jaz Fresh pointed out that if you used "-r [number]" as was wrongly described - in the man page, curl would send an invalid HTTP Range: header. The correct - way would be to use "-r [number]-" or even "-r -[number]". Starting now, - curl will warn if this is discovered, and automatically append a dash to the - range before passing it to libcurl. - -Daniel (25 October 2005) -- Amol Pattekar reported a bug with great detail and a fine example in bug - #1326306 (https://curl.haxx.se/bug/view.cgi?id=1326306). When using the multi - interface and connecting to a host with multiple IP addresses, and one of - the addresses fails to connect (the server must exist and respond, just not - accept connections) libcurl leaks a socket descriptor. Thanks to the fine - report, I could find and fix this. - -Daniel (22 October 2005) -- Dima Barsky reported a problem with GnuTLS-enabled libcurl in bug report - #1334338 (https://curl.haxx.se/bug/view.cgi?id=1334338). When reading an SSL - stream from a server and the server requests a "rehandshake", the current - code simply returns this as an error. I have no good way to test this, but - I've added a crude attempt of dealing with this situation slightly better - - it makes a blocking handshake if this happens. Done like this because fixing - this the "proper" way (that would handshake asynchronously) will require - quite some work and I really need a good way to test this to do such a - change. - -Daniel (21 October 2005) -- "Ofer" reported a problem when libcurl re-used a connection and failed to do - it, it could then accidentally actually crash. Presumably, this concerns FTP - connections. https://curl.haxx.se/bug/view.cgi?id=1330310 - -- Temprimus improved the MSVC makefile so that the static debug SSL libs are - linked to the executable and not to the libcurld.lib - https://curl.haxx.se/bug/view.cgi?id=1326676 - -- Bradford Bruce made the windows resolver code properly return - CURLE_COULDNT_RESOLVE_PROXY and CURLE_COULDNT_RESOLVE_HOST on resolving - errors (as documented). - -Daniel (20 October 2005) -- Dave Dribin made libcurl understand and handle cases when the server - (wrongly) sends *two* WWW-Authenticate headers for Digest. While this should - never happen in a sane world, libcurl previously got into an infinite loop - when this occurred. Dave added test 273 to verify this. - -- Temprimus improved the MSVC makefile: "makes a build option available so if - you set rtlibcfg=static for the make, then it would build with /MT. The - default behaviour is /MD (the original)." - https://curl.haxx.se/bug/view.cgi?id=1326665 - -Daniel (14 October 2005) -- Reverted the LIBCURL_VERSION_NUM change from October 6. As Dave Dribin - reported, the define is used by the configure script and is assumed to use - the 0xYYXXZZ format. This made "curl-config --vernum" fail in the 7.15.0 - release version. - -Version 7.15.0 (13 October 2005) - -Daniel (12 October 2005) -- Michael Sutton of iDEFENSE reported and I fixed a securitfy flaw in the NTLM - code that would overflow a buffer if given a too long user name or domain - name. This would happen if you enable NTLM authentication and either - - A - pass in a user name and domain name to libcurl that together are longer - than 192 bytes - - B - allow (lib)curl to follow HTTP "redirects" (Location: and the - appropriate HTTP 30x response code) and the new URL contains a URL with - a user name and domain name that together are longer than 192 bytes - - See https://curl.haxx.se/docs/security.html for further details and updates - -Daniel (5 October 2005) -- Darryl House reported a problem with using -z to download files from FTP. - It turned out that if the given time stamp was exact the same as the remote - time stamp, the file would still wrongly be downloaded. Added test case 272 - to verify. - -Daniel (4 October 2005) -- Domenico Andreoli fixed a man page malformat and removed odd (0xa0) bytes - from the configure script. - -- Michael Wallner reported that the date parser had wrong offset stored for - the MEST and CEST time zones. - -Daniel (27 September 2005) -- David Yan filed bug #1299181 (https://curl.haxx.se/bug/view.cgi?id=1299181) - that identified a silly problem with Content-Range: headers with the 'bytes' - keyword written in a different case than all lowercase! It would cause a - segfault! - -- TJ Saunders of the proftpd project identified and pointed out problems with - the modified FTPS negotiation change of August 19 2005. Thus, we revert the - change back to pre-7.14.1 status. - -Daniel (21 September 2005) -- Fixed "cut off" sentence in the libcurl-tutorial man page: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=329305 - -- Clarified in the curl_easy_setopt man page what the default - CURLOPT_WRITEFUNCTION and CURLOPT_WRITEDATA mean: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=329311 - -- Clarified in the curl_easy_setopt man page that CURLOPT_ERRORBUFFER - sometimes doesn't fill in the buffer even though it is supposed to: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=329313 - -- When CURLE_URL_MALFORMAT is returned due to a missing URL, it now has an - error string set. - -Daniel (19 September 2005) -- Dmitry Bartsevich made the SSPI support work on Windows 9x as well. - -Daniel (15 September 2005) -- Added a TFTP server to the test suite and made the test suite capable of - using it. - -Daniel (7 September 2005) -- Ben Madsen's detailed reports that funnily enough only occurred with certain - glibc versions turned out to be curl using an already closed file handle - during certain conditions (like when saving FTP server "headers"). - -- Scott Davis helped me track down a problem in the test HTTP server that made - test case 56 wrongly fail at times. It turned out it was due to the server - finding the end of a chunked-encoded POST too early. - -Daniel (6 September 2005) -- Now curl warns if an unknown variable is used in the -w/--writeout argument. - -Daniel (4 September 2005) -- I applied Nicolas François' man page patch he posted to the Debian bug - tracker. It corrected two lines that started with apostrophes, which isn't - legal nroff format. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=326511 - -- Added --ftp-skip-pasv-ip to the command line tool, that sets the new - CURLOPT_FTP_SKIP_PASV_IP option. It makes libcurl re-use the control - connection's IP address when setting up the data connection instead of - extractting the IP address from the PASV response. It has turned out this - feature is frequently needed by people to circumvent silly servers and silly - firewalls, especially when FTPS is used and the PASV command-response is - sent encrtyped. - - Sponsored by CU*Answers - -Daniel (1 September 2005) -- John Kelly added TFTP support to libcurl. A bunch of new error codes was - added. TODO: add them to docs. add TFTP server to test suite. add TFTP to - list of protocols whereever those are mentioned. - -Version 7.14.1 (1 September 2005) - -Daniel (29 August 2005) -- Kevin Lussier pointed out a problem with curllib.dsp and how to fix it. - -- Igor Polyakov fixed a rather nasty problem with the threaded name resolver - for Windows, that could lead to an Access Violation when the multi interface - was used due to an issue with how the resolver thread was and was not - terminated. - -- Simon Josefsson brought a patch that allows curl to get built to use GNU GSS - instead of MIT/Heimdal for GSS capabilities. - -Daniel (24 August 2005) -- Toby Peterson added CURLOPT_IGNORE_CONTENT_LENGTH to the library, accessible - from the command line tool with --ignore-content-length. This will make it - easier to download files from Apache 1.x (and similar) servers that are - still having problems serving files larger than 2 or 4 GB. When this option - is enabled, curl will simply have to wait for the server to close the - connection to signal end of transfer. I wrote test case 269 that runs a - simple test to verify that this works. - -- (Trying hard to exclude emotions now.) valgrind version 3 suddenly renamed - the --logfile command line option to --log-file, and thus the test script - valgrind autodetection now has yet another version check to do and then it - alters the valgrind command line accordingly. - -- Fixed CA cert verification using GnuTLS with the default bundle, which - previously failed due to GnuTLS not allowing x509 v1 CA certs by default. - Ralph Mitchell reported. - -Daniel (19 August 2005) -- Norbert Novotny had problems with FTPS and he helped me work out a patch - that made curl run fine in his end. The key was to make sure we do the - SSL/TLS negotiation immediately after the TCP connect is done and not after - a few other commands have been sent like we did previously. I don't consider - this change necessary to obey the standards, I think this server is pickier - than what the specs allow it to be, but I can't see how this modified - libcurl code can add any problems to those who are interpreting the - standards more liberally. - -Daniel (17 August 2005) -- Jeff Pohlmeyer found out that if you ask libcurl to load a cookiefile (with - CURLOPT_COOKIEFILE), add a cookie (with CURLOPT_COOKIELIST), tell it to - write the result to a given cookie jar and then never actually call - curl_easy_perform() - the given file(s) to read was never read but the - output file was written and thus it caused a "funny" result. - -- While doing some tests for the bug above, I noticed that Firefox generates - large numbers (for the expire time) in the cookies.txt file and libcurl - didn't treat them properly. Now it does. - -Daniel (15 August 2005) -- Added more verbose "warning" messages to the curl client for cases where it - fails to open/read files etc to help users diagnose why it doesn't do what - you'd expect it to. Converted lots of old messages to use the new generic - function I wrote for this purpose. - -Daniel (13 August 2005) -- James Bursa identified a libcurl HTTP bug and a good way to repeat it. If a - site responds with bad HTTP response that doesn't contain any header at all, - only a response body, and the write callback returns 0 to abort the - transfer, it didn't have any real effect but the write callback would be - called once more anyway. - -Daniel (12 August 2005) -- Based on Richard Clayton's reports, I found out that using curl -d @filename - when 'filename' was not possible to access made curl use a GET request - instead. - -- The time condition illegal syntax warning is now inhibited if -s is used. - -Daniel (10 August 2005) -- Mario Schroeder found out that one of the debug callbacks calls that regards - SSL data with the CURLINFO_TEXT type claimed that the data was one byte - larger than it actually is, thus falsely telling the application that the - terminating zero was part of the data. - -Daniel (9 August 2005) -- Christopher R. Palmer fixed the offsets used for date parsings when the time - zone name of a daylight savings time was used. For example, PDT vs PDS. This - flaw was introduced with the new date parser (11 sep 2004 - 7.12.2). - Fortunately, no web server or cookie string etc should be using such time - zone names thus limiting the effect of this bug. - -Daniel (8 August 2005) -- Jon Grubbs filed bug report #1249962 - (https://curl.haxx.se/bug/view.cgi?id=1249962) which identified a problem - with NTLM on a HTTP proxy if an FTP URL was given. libcurl now properly - switches to pure HTTP internally when an HTTP proxy is used, even for FTP - URLs. The problem would also occur with other multi-pass auth methods. - -Daniel (7 August 2005) -- When curl is built with GnuTLS, curl-config didn't include "SSL" when - --features was used. - -Daniel (28 July 2005) -- If any of the options CURLOPT_HTTPGET, CURLOPT_POST and CURLOPT_HTTPPOST is - set to 1, CURLOPT_NOBODY will now automatically be set to 0. - -Daniel (27 July 2005) -- Dan Fandrich changes over the last week: fixed numerous minor configure - option parsing flaws: --without-gnutls, --without-spnego --without-gssapi - and --without-krb4. Spellfixed several error messages. - -- Peteris Krumins added CURLOPT_COOKIELIST and CURLINFO_COOKIELIST, which is a - simple interface to extracting and setting cookies in libcurl's internal - "cookie jar". See the new cookie_interface.c example code. - -Daniel (13 July 2005) -- Diego Casorran provided patches to make curl build fine on Amiga again. - -Daniel (12 July 2005) -- Adrian Schuur added trailer support in the chunked encoding stream. The - trailer is then sent to the normal header callback/stream. I wrote up test - case 266 to verify the basic functionality. Do note that test case 34 - contains a flawed chunked encoding stream that still works the same. - -Daniel (5 July 2005) -- Gisle Vanem came up with a nice little work-around for bug #1230118 - (https://curl.haxx.se/bug/view.cgi?id=1230118). It seems the Windows (MSVC) - libc time functions may return data one hour off if TZ is not set and - automatic DST adjustment is enabled. This made curl_getdate() return wrong - value, and it also concerned internal cookie expirations etc. - -Daniel (4 July 2005) -- Andrew Bushnell provided enough info for me to tell that we badly needed to - fix the CONNECT authentication code with multi-pass auth methods (such as - NTLM) as it didn't previously properly ignore response-bodies - in fact it - stopped reading after all response headers had been received. This could - lead to libcurl sending the next request and reading the body from the first - request as response to the second request. (I also renamed the function, - which wasn't strictly necessary but...) - - The best fix would to once and for all make the CONNECT code use the - ordinary request sending/receiving code, treating it as any ordinary request - instead of the special-purpose function we have now. It should make it - better for multi-interface too. And possibly lead to less code... - - Added test case 265 for this. It doesn't work as a _really_ good test case - since the test proxy is too stupid, but the test case helps when running the - debugger to verify. - -Daniel (30 June 2005) -- Dan Fandrich improved the configure script's ability to figure out what kind - of strerror_r() API that is used when cross-compiling. If __GLIB__ is - defined, it assumes the glibc API. If not, it issues a notice as before that - the user needs to manually edit lib/config.h for this. - -Daniel (23 June 2005) -- David Shaw's fix that unifies proxy string treatment so that a proxy given - with CURLOPT_PROXY can use a http:// prefix and user + password. The user - and password fields are now also URL decoded properly. Test case 264 added - to verify. - -Daniel (22 June 2005) -- David Shaw updated libcurl.m4 - -Daniel (14 June 2005) -- Gisle Vanem fixed a potential thread handle leak. Bug report #1216500 - (https://curl.haxx.se/bug/view.cgi?id=1216500). Comment in - https://curl.haxx.se/mail/lib-2005-06/0059.html - -Daniel (13 June 2005) -- Made buildconf run libtoolize in the ares dir too (inspired by Tupone's - reverted patch). - -Daniel (9 June 2005) -- Incorporated Tupone's findtool fix in buildconf (slightly edited) - -- Incorporated Tupone's head -n fix in buildconf. - -Daniel (8 June 2005) -- Reverted Tupone's patch again, it broke numerous autobuilds. Let's apply it - in pieces, one by one and see what we need to adjust to work all over. - -Daniel (6 June 2005) -- Tupone Alfredo fixed three problems in buildconf: - - 1) findtool does look per tool in PATH and think ./perl is the perl - executable, while is just a local directory (I have . in the PATH) - - 2) I got several warning for head -1 deprecated in favour of head -n 1 - - 3) ares directory is missing some file (missing is missing :-) ) because - automake and friends is not run. - -Daniel (3 June 2005) -- Added docs/libcurl/getinfo-times, based on feedback from 'Edi': - https://curl.haxx.se/feedback/display.cgi?id=11178325798299&support=yes - -- Andres Garcia provided yet another text mode patch for several test cases so - that they do text comparisions better on Windows (newline-wise). - -Daniel (1 June 2005) -- The configure check for c-ares now adds the cares lib before the other libs, - to make it build fine with mingw. Inspired by Tupone Alfredo's bug report - and patch: https://curl.haxx.se/bug/view.cgi?id=1212940 - -Daniel (31 May 2005) -- Todd Kulesza reported a flaw in the proxy option, since a numerical IPv6 - address was not possible to use. It is now, but requires it written - RFC2732-style, within brackets - which incidently is how you enter numerical - IPv6 addresses in URLs. Test case 263 added to verify. - -Daniel (30 May 2005) -- Eric Cooper reported about a problem with HTTP servers that responds with - binary zeroes within the headers. They confused libcurl to do wrong so the - downloaded headers become incomplete. The fix is now verified with test case - 262. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=310948 - -Daniel (25 May 2005) -- Fixed problems with the test suite, and in particular the FTP test cases - since it previously was failing every now and then in a nonsense manner. - -- --trace-time now outputs the full microsecond, all 6 digits. - -Daniel (24 May 2005) -- Andres Garcia provided a text mode patch for several test cases so that they - do text comparisions better on Windows (newline-wise). - -- Any 2xx response (and not just 200) is now considered a fine response to - TYPE, as some servers obviously sends a 226 there. Added test case 261 to - verify. Based on a question/report by Georg Wicherski. - -Daniel (20 May 2005) -- Improved runtests.pl to allow stdout tests to be mode=text as well, just - as file comparisons already supports. Added this info to the FILEFORMAT - docs. - -Daniel (18 May 2005) -- John McGowan identified a problem in bug report #1204435 - (https://curl.haxx.se/bug/view.cgi?id=1204435) with malformed URLs like - "http://somehost?data" as it added a slash too much in the request ("GET - /?data/"...). Added test case 260 to verify. - -- The configure check for strerror_r() failed to detect the proper API at - times, like on HP-UX 10.20. Then lib/strerror.c badly assumed the glibc - version if the posix define wasn't set (since it _had_ found a strerror_r). - -Daniel (16 May 2005) -- The gmtime_r() function in HP-UX 10.20 is broken. About 13 test cases fail - due to this. There's now a configure check that attempts to detect the bad - function and not use it on such systems. - -Version 7.14.0 (16 May 2005) - -Daniel (13 May 2005) -- Grigory Entin reported that curl's configure detects a fine poll() for Mac - OS X 10.4 (while 10.3 or later detected a "bad" one), but the executable - doesn't work as good as if built without poll(). I've adjusted the configure - to always skip the fine-poll() test on Mac OS X (darwin). - -Daniel (12 May 2005) -- When doing a second request (after a disconnect) using the same easy handle, - over a proxy that uses NTLM authentication, libcurl failed to use NTLM again - properly (the auth method was accidentally reset to the same as had been set - for host auth, which defaults to Basic). Bug report #1200661 - (https://curl.haxx.se/bug/view.cgi?id=1200661) identified the the problem and - the fix. - -- If -z/--time-cond is used with an invalid date syntax, this is no longer - silently discarded. Instead a proper warning message is diplayed that - informs about it. But it still continues without the condition. - -Version 7.14.0-pre2 (11 May 2005) - -Daniel (11 May 2005) -- Starting now, libcurl sends a little different set of headers in its default - HTTP requests: - - A) Normal non-proxy HTTP: - - no more "Pragma: no-cache" (this only makes sense to proxies) - - B) Non-CONNECT HTTP request over proxy: - - "Pragma: no-cache" is used (like before) - - "Proxy-Connection: Keep-alive" (for older style 1.0-proxies) - - C) CONNECT HTTP request over proxy: - - "Host: [name]:[port]" - - "Proxy-Connection: Keep-alive" - - The A) case is mostly to reduce the default header size and remove a - pointless header. - - The B) is to address (rare) problems with HTTP 1.0 proxies - - The C) headers are both to address (rare) problems with some proxies. The - code in libcurl that deals with CONNECT requests need a rewrite, but it - feels like a too big a job for me to do now. Details are added in the code - comments for now. - - Updated a large amount of test cases to reflect the news. - -Daniel (10 May 2005) -- Half-baked attempt to bail out if select() returns _only_ errorfds when the - transfer is in progress. An attempt to fix Allan's problem. See - https://curl.haxx.se/mail/lib-2005-05/0073.html and the rest of that thread - for details. - - I'm still not sure this is the right fix, but... - -Version 7.14.0-pre1 (9 May 2005) - -Daniel (2 May 2005) -- Sort of "fixed" KNOWN_BUGS #4: curl now builds IPv6 enabled on AIX 4.3. At - least it should no longer cause a compiler error. However, it does not have - AI_NUMERICHOST so we cannot getaddrinfo() any numerical addresses with it - (we use that for FTP PORT/EPRT)! So, I modified the configure check that - checks if the getaddrinfo() is working, to use AI_NUMERICHOST since then - it'll fail on AIX 4.3 and it will automatically build with IPv6 support - disabled. - -- Added --trace-time that when used adds a time stamp to each trace line that - --trace, --trace-ascii and --verbose output. I also made the '>' display - separate each line on the linefeed so that HTTP requests etc look nicer in - the -v output. - -- Made curl recognize the environment variables Lynx (and others?) support for - pointing out the CA cert path/file: SSL_CERT_DIR and SSL_CERT_FILE. If - CURL_CA_BUNDLE is not set, they are checked afterwards. - - Like before: on windows if none of these are set, it checks for the ca cert - file like this: - - 1. application's directory - 2. current working directory - 3. Windows System directory (e.g. C:\windows\system32) - 4. Windows Directory (e.g. C:\windows) - 5. all directories along %PATH% - -Daniel (1 May 2005) -- The runtests.pl script now starts test servers by doing fork() and exec() - instead of the previous approach. This is less complicated and should - hopefully lead to less "leaked" servers (servers that aren't stopped - properly when the tests are stopped). - -- Alexander Zhuravlev found a case when you did "curl -I [URL]" and it - complained on the chunked encoding, even though a HEAD should never return a - body and thus it cannot be a chunked-encoding problem! - -Daniel (30 April 2005) -- Alexander Zhuravlev found out that (lib)curl SIGSEGVed when using - --interface on an address that can't be bound. - -Daniel (28 April 2005) -- Working on fixing up test cases to mark sections as 'mode=text' for things - that curl writes as text files, since then they can get different line - endings depending on OS. Andrés García helps me work this out. - - Did lots of other minor tweaks on the test scripts to work better and more - reliably find test servers and also kill test servers. - -- Dan Fandrich pointed out how the runtests.pl script killed the HTTP server - instead of the HTTPS server when closing it down. - -Daniel (27 April 2005) -- Paul Moore made curl check for the .curlrc file (_curlrc on windows) on two - more places. First, CURL_HOME is a new environment variable that is used - instead of HOME if it is set, to point out where the default config file - lives. If there's no config file in the dir pointed out by one of the - environment variables, the Windows version will instead check the same - directory the executable curl is located in. - -Daniel (26 April 2005) -- Cory Nelson's work on nuking compiler warnings when building on x64 with - VS2005. - -Daniel (25 April 2005) -- Fred New reported a bug where we used Basic auth and user name and password - in .netrc, and when following a Location: the subsequent requests didn't - properly use the auth as found in the netrc file. Added test case 257 to - verify my fix. - -- Based on feedback from Cory Nelson, I added some preprocessor magic in - */setup.h and */config-win32.h to build fine with VS2005 on x64. - -Daniel (23 April 2005) -- Alex Suykov made the curl tool now assume that uploads using HTTP:// or - HTTPS:// are the only ones that show output and thus motivates a switched - off progress meter if the output is sent to the terminal. This makes FTP - uploads without '>', -o or -O show the progress meter. - -Daniel (22 April 2005) -- Dave Dribin's MSVC makefile fix: set CURL_STATICLIB when it builds static - library variants. - -- Andres Garcia fixed configure to set the proper define when building static - libcurl on windows. - -- --retry-delay didn't work. - -Daniel (18 April 2005) -- Olivier reported that even though he used CURLOPT_PORT, libcurl clearly - still used the default port. He was right. I fixed the problem and added the - test cases 521, 522 and 523 to verify the fix. - -- Toshiyuki Maezawa reported that when doing a POST with a read callback, - libcurl didn't properly send an Expect: 100-continue header. It does now. - -- I committed by mig change in the test suite's FTP server that moves out all - socket/TCP code to a separate C program named sockfilt. And added 4 new - test cases for FTP over IPv6. - -Daniel (8 April 2005) -- Cory Nelson reported a problem with a HTTP server that responded with a 304 - response containing an "illegal" Content-Length: header, which was not - properly ignored by libcurl. Now it is. Test case 249 verifies. - -Daniel (7 April 2005) -- Added ability to build and run with GnuTLS as an alternative to OpenSSL for - the secure layer. configure --with-gnutls enables with. Note that the - previous OpenSSL check still has preference and if it first detects OpenSSL, - it will not check for GnuTLS. You may need to explictly diable OpenSSL with - --without-ssl. - - This work has been sponsored by The Written Word. - -Daniel (5 April 2005) -- Christophe Legry fixed the post-upload check for FTP to not complain if the - upload was skipped due to a time-condition as set with - CURLOPT_TIMECONDITION. I added test case 247 and 248 to verify. - -Version 7.13.2 (5 April 2005) - -Daniel (4 April 2005) -- Marcelo Juchem fixed the MSVC makefile for libcurl - -- Gisle Vanem fixed a crash in libcurl, that could happen if the easy handle - was killed before the threading resolver (windows only) still hadn't - completed. - -- Hardeep Singh reported a problem doing HTTP POST with Digest. (It was - actually also affecting NTLM and Negotiate.) It turned out that if the - server responded with 100 Continue before the initial 401 response, libcurl - didn't take care of the response properly. Test case 245 and 246 added to - verify this. - -Daniel (30 March 2005) -- Andres Garcia modified the configure script to check for libgdi32 before - libcrypto, to make the SSL check work fine on msys/mingw. - -Daniel (29 March 2005) -- Tom Moers identified a flaw when you sent a POST with Digest authentication, - as in the first request when curl sends a POST with Content-Length: 0, it - still forcibly closed the connection before doing the next step in the auth - negotiation. - -- Jesper Jensen found out that FTP-SSL didn't work since my FTP - rewrite. Fixing that was easy, but it also revealed a much worse problem: - the FTP server response reader function didn't properly deal with reading - responses in multiple tiny chunks properly! I modified the FTP server to - allow it to produce such split-up responses to make sure curl deals with - them as it should. - -- Based on Augustus Saunders' comments and findings, the HTTP output auth - function was fixed to use the proper proxy authentication when multiple ones - are accepted. test 239 and test 243 were added to repeat the problems and - verify the fixes. - - --proxy-anyauth was added to the curl tool - -Daniel (16 March 2005) -- Tru64 and some IRIX boxes seem to not like test 237 as it is. Their - inet_addr() functions seems to use &255 on all numericals in a ipv4 dotted - address which makes a different failure... Now I've modified the IPv4 - resolve code to use inet_pton() instead in an attempt to make these systems - better detect this as a bad IP address rather than creating a toally bogus - address that is then passed on and used. - -Daniel (15 March 2005) -- Dan Fandrich made the code properly use the uClibc's version of - inet_ntoa_r() when built with it. - -- Added test 237 and 238: test EPSV and PASV response handling when they get - well- formated data back but using illegal values. In 237 PASV gets an IP - address that is way bad. In 238 EPSV gets a port that is way out of range. - -Daniel (14 March 2005) -- Added a few missing features to the curl-config --features list - -- Modified testcurl.pl to now offer - 1 - command line options for all info it previously only read from - file: --name, --email, --desc and --configure - 2 - --nocvsup makes it not attempt to do cvs update - 3 - --crosscompile informs it and makes it not attempt things it can't do - -- Fixed numerous win32 compiler warnings. - -- Removed the lib/security.h file since it shadowed the mingw/win32 header - with the same name which is needed for SSPI builds. The contents of the - former security.h is now i krb4.h - -- configure --enable-sspi now enables SSPI in the build. It only works for - windows builds (including cross-compiles for windows). - -Daniel (12 March 2005) -- David Houlder added --form-string that adds that string to a multipart - formpost part, without special characters having special meanings etc like - --form features. - -Daniel (11 March 2005) -- curl_version_info() returns the feature bit CURL_VERSION_SSPI if it was - built with SSPI support. - -- Christopher R. Palmer made it possible to build libcurl with the - USE_WINDOWS_SSPI on Windows, and then libcurl will be built to use the - native way to do NTLM. SSPI also allows libcurl to pass on the current user - and its password in the request. - -Daniel (9 March 2005) -- Dan F improved the SSL lib setup in configure. - -- Nodak Sodak reported a crash when using a SOCKS4 proxy. - -- Jean-Marc Ranger pointed out an embarassing debug printf() leftover in the - multi interface code. - -- Adjusted the man page for the curl_getdate() return value for dates after - year 2038. For 32 bit time_t it returns 0x7fffffff but for 64bit time_t it - returns either the correct value or even -1 on some systems that still seem - to not deal with this properly. Tor Arntsen found a 64bit AIX system for us - that did the latter. Gwenole Beauchesne's Mandrake patch put the lights on - this problem in the first place. - -Daniel (8 March 2005) -- Dominick Meglio reported that using CURLOPT_FILETIME when transferring a FTP - file got a Last-Modified: header written to the data stream, corrupting the - actual data. This was because some conditions from the previous FTP code was - not properly brought into the new FTP code. I fixed and I added test case - 520 to verify. (This bug was introduced in 7.13.1) - -- Dan Fandrich fixed the configure --with-zlib option to always consider the - given path before any standard paths. - -Daniel (6 March 2005) -- Randy McMurchy was the first to report that valgrind.pm was missing from the - release archive and thus 'make test' fails. - -Daniel (5 March 2005) -- Dan Fandrich added HAVE_FTRUNCATE to several config-*.h files. - -- Added test case 235 that makes a resumed upload of a file that isn't present - on the remote side. This then converts the operation to an ordinary STOR - upload. This was requested/pointed out by Ignacio Vazquez-Abrams. - - It also proved (and I fixed) a bug in the newly rewritten ftp code (and - present in the 7.13.1 release) when trying to resume an upload and the - servers returns an error to the SIZE command. libcurl then loops and sends - SIZE commands infinitely. - -- Dan Fandrich fixed a SSL problem introduced on February 9th that made - libcurl attempt to load the whole random file to seed the PRNG. This is - really bad since this turns out to be using /dev/urandom at times... - -Version 7.13.1 (4 March 2005) - -Daniel (4 March 2005) -- Dave Dribin made it possible to set CURLOPT_COOKIEFILE to "" to activate - the cookie "engine" without having to provide an empty or non-existing file. - -- Rene Rebe fixed a -# crash when more data than expected was retrieved. - -Daniel (22 February 2005) -- NTLM and ftp-krb4 buffer overflow fixed, as reported here: - http://www.securityfocus.com/archive/1/391042 and the CAN report here: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0490 - - If these security guys were serious, we'd been notified in advance and we - could've saved a few of you a little surprise, but now we weren't. - -Daniel (19 February 2005) -- Ralph Mitchell reported a flaw when you used a proxy with auth, and you - requested data from a host and then followed a redirect to another - host. libcurl then didn't use the proxy-auth properly in the second request, - due to the host-only check for original host name wrongly being extended to - the proxy auth as well. Added test case 233 to verify the flaw and that the - fix removed the problem. - -Daniel (18 February 2005) -- Mike Dobbs reported a mingw build failure due to the lack of - BUILDING_LIBCURL being defined when libcurl is built. Now this is defined by - configure when mingw is used. - -Daniel (17 February 2005) -- David in bug report #1124588 found and fixed a socket leak when libcurl - didn't close the socket properly when returning error due to failing - localbind - -Daniel (16 February 2005) -- Christopher R. Palmer reported a problem with HTTP-POSTing using "anyauth" - that picks NTLM. Thanks to David Byron letting me test NTLM against his - servers, I could quickly repeat and fix the problem. It turned out to be: - - When libcurl POSTs without knowing/using an authentication and it gets back - a list of types from which it picks NTLM, it needs to either continue - sending its data if it keeps the connection alive, or not send the data but - close the connection. Then do the first step in the NTLM auth. libcurl - didn't send the data nor close the connection but simply read the - response-body and then sent the first negotiation step. Which then failed - miserably of course. The fixed version forces a connection if there is more - than 2000 bytes left to send. - -Daniel (14 February 2005) -- The configure script didn't check for ENGINE_load_builtin_engines() so it - was never used. - -Daniel (11 February 2005) -- Removed all uses of strftime() since it uses the localised version of the - week day names and month names and servers don't like that. - -Daniel (10 February 2005) -- Now the test script disables valgrind-testing when the test suite runs if - libcurl is built shared. Otherwise valgrind only tests the shell that runs - the wrapper-script named 'curl' that is a front-end to curl in this case. - This should also fix the huge amount of reports of false positives when - valgrind has identified leaks in (ba)sh and not in curl and people report - that as curl bugs. Bug report #1116672 is one example. - - Also, the valgrind report parser has been adapted to check that at least one - of the sources in a stack strace is one of (lib)curl's source files or - otherwise it will not consider the problem to concern (lib)curl. - -- Marty Kuhrt streamlined the VMS build. - -Daniel (9 February 2005) -- David Byron fixed his SSL problems, initially mentioned here: - https://curl.haxx.se/mail/lib-2005-01/0240.html. It turned out we didn't use - SSL_pending() as we should. - -- Converted lots of FTP code to a statemachine, so that the multi interface - doesn't block while communicating commands-responses with an FTP server. - - I've added a comment like BLOCKING in the code on all spots I could find - where we still have blocking operations. When we change curl_easy_perform() - to use the multi interface, we'll also be able to simplify the code since - there will only be one "internal interface". - - While doing this, I've now made CURLE_FTP_ACCESS_DENIED separate from the - new CURLE_LOGIN_DENIED. The first one is now access denied to a function, - like changing directory or retrieving a file, while the second means that we - were denied login. - - The CVS tag 'before_ftp_statemachine' was set just before this went in, in - case of future need. - -- Gisle made the DICT code send CRLF and not just LF as the spec says so. - -Daniel (8 February 2005) -- Gisle fixed problems when libcurl runs out of memory, and worked on making - sure the proper error code is returned for those occations. - -Daniel (7 February 2005) -- Maruko pointed out a problem with inflate decompressing exactly 64K - contents. - -Daniel (5 February 2005) -- Eric Vergnaud found a use of an uninitialised variable in the ftp when doing - PORT on IPv6-enabled hosts. - -- David Byron pointed out we could use BUFSIZE to read data (in - lib/transfer.c) instead of using BUFSIZE -1. - -Version 7.13.0 (1 February 2005) - -Daniel (31 January 2005) -- Added Lars Nilsson's htmltitle.cc example - -Daniel (30 January 2005) -- Fixed a memory leak when using the multi interface and the DO operation - failed (as in test case 205). - -- Fixed a valgrind warning for file:// operations. - -- Fixed a valgrind report in the url globbing code for the curl command line - tool. - -- Bugfixed the parser that scans the valgrind report outputs (in runtests.pl). - I noticed that it previously didn't detect and report the "Conditional jump - or move depends on uninitialised value(s)" error. When I fixed this, I - caught a few curl bugs with it. And then I had to spend time to make the - test suite IGNORE these errors when OpenSSL is used since it produce massive - amounts of valgrind warnings (but only of the "Conditional..." kind it - seems). So, if a test that requires SSL is run, it ignores the - "Conditional..." errors, and you'll get a "valgrind PARTIAL" output instead - of "valgrind OK". - -Daniel (29 January 2005) -- Using the multi interface, and doing a requsted a re-used connection that - gets closed just after the request has been sent failed and did not re-issue - a request on a fresh reconnect like the easy interface did. Now it does! - -- Define CURL_MULTIEASY when building libcurl (lib/easy.c to be exact), to use - my new curl_easy_perform() that uses the multi interface to run the - request. It is a great testbed for the multi interface and I believe we - shall do it this way for real in the future when we have a successor to - curl_multi_fdset(). I've used this approach to detect and fix several of the - recent multi-interfaces issues. - -- Adjusted the KNOWN_BUGS #17 fix a bit more since the FTP code also did some - bad assumptions. - -- multi interface: when a request is denied due to "Maximum redirects - followed" libcurl leaked the last Location: URL. - -- Connect failures with the multi interface was often returned as "connect() - timed out" even though the reason was different. - -Daniel (28 January 2005) -- KNOWN_BUGS #17 fixed. A DNS cache entry may not remain locked between two - curl_easy_perform() invokes. It was previously unlocked at disconnect, which - could mean that it remained locked between multiple transfers. The DNS cache - may not live as long as the connection cache does, as they are separate. - - To deal with the lack of DNS (host address) data availability in re-used - connections, libcurl now keeps a copy of the IP adress as a string, to be - able to show it even on subsequent requests on the same connection. - - The problem could be made to appear with this stunt: - - 1. create a multi handle - 2. add an easy handle - 3. fetch a URL that is persistent (leaves the connection alive) - 4. remove the easy handle from the multi - 5. kill the multi handle - 6. create a multi handle - 7. add the same easy handle to the new multi handle - 8. fetch a URL from the same server as before (re-using the connection) - -- Stephen More pointed out that CURLOPT_FTPPORT and the -P option didn't work - when built IPv6-enabled. I've now made a fix for it. Writing test cases for - custom port hosts turned too tricky so unfortunately there's none. - -Daniel (25 January 2005) -- Ian Ford asked about support for the FTP command ACCT, and I discovered it - is present in RFC959... so now (lib)curl supports it as well. --ftp-account - and CURLOPT_FTP_ACCOUNT set the account string. (The server may ask for an - account string after PASS have been sent away. The client responds - with "ACCT [account string]".) Added test case 228 and 229 to verify the - functionality. Updated the test FTP server to support ACCT somewhat. - -- David Shaw contributed a fairly complete and detailed autoconf test you can - use to detect libcurl and setup variables for the protocols the installed - libcurl supports: docs/libcurl/libcurl.m4 - -Daniel (21 January 2005) -- Major FTP third party transfer overhaul. - - These four options are now obsolete: CURLOPT_SOURCE_HOST, - CURLOPT_SOURCE_PATH, CURLOPT_SOURCE_PORT (this option didn't work before) - and CURLOPT_PASV_HOST. - - These two options are added: CURLOPT_SOURCE_URL and CURLOPT_SOURCE_QUOTE. - - The target-side didn't use the proper path with RETR, and thus this only - worked correctly in the login path (i.e without doing any CWD). The source- - side still uses a wrong path, but the fix for this will need to wait. Verify - the flaw by using a source URL with included %XX-codes. - - Made CURLOPT_FTPPORT control weather the target operation should use PORT - (or not). The other side thus uses passive (PASV) mode. - - Updated the ftp3rdparty.c example source to use the updated options. - - Added support for a second FTP server in the test suite. Named... ftp2. - Added test cases 230, 231 and 232 as a few first basic tests of very simple - 3rd party transfers. - - Changed the debug output to include 'target' and 'source' when a 3rd party - is being made, to make it clearer what commands/responses came on what - connection. - - Added three new command line options: --3p-url, --3p-user and --3p-quote. - - Documented the command line options and the curl_easy_setopt options related - to third party transfers. - - (Temporarily) disabled the ability to re-use an existing connection for the - source connection. This is because it needs to force a new in case the - source and target is the same host, and the host name check is trickier now - when the source is identified with a full URL instead of a plain host name - like before. - - TODO (short-term) for 3rd party transfers: quote support. The options are - there, we need to add test cases to verify their functionality. - - TODO (long-term) for 3rd party transfers: IPv6 support (EPRT and EPSV etc) - and SSL/TSL support. - -Daniel (20 January 2005) -- Philippe Hameau found out that -Q "+[command]" didn't work, although some - code was written for it. I fixed and added test case 227 to verify it. - The curl.1 man page didn't mention the '+' so I added it. - -Daniel (19 January 2005) -- Stephan Bergmann made libcurl return CURLE_URL_MALFORMAT if an FTP URL - contains %0a or %0d in the user, password or CWD parts. (A future fix would - include doing it for %00 as well - see KNOWN_BUGS for details.) Test case - 225 and 226 were added to verify this - -- Stephan Bergmann pointed out two flaws in libcurl built with HTTP disabled: - - 1) the proxy environment variables are still read and used to set HTTP proxy - - 2) you couldn't disable http proxy with CURLOPT_PROXY (since the option was - disabled). This is important since apps may want to disable HTTP proxy - without actually knowing if libcurl was built to disable HTTP or not. - - Based on Stephan's patch, both these issues should now be fixed. - -Daniel (18 January 2005) -- Cody Jones' enhanced version of Samuel Díaz García's MSVC makefile patch was - applied. - -Daniel (16 January 2005) -- Alex aka WindEagle pointed out that when doing "curl -v dictionary.com", curl - assumed this used the DICT protocol. While guessing protocols will remain - fuzzy, I've now made sure that the host names must start with "[protocol]." - for them to be a valid guessable name. I also removed "https" as a prefix - that indicates HTTPS, since we hardly ever see any host names using that. - -Daniel (13 January 2005) -- Inspired by Martijn Koster's patch and example source at - http://www.greenhills.co.uk/mak/gentoo/curl-eintr-bug.c, I now made the - select() and poll() calls properly loop if they return -1 and errno is - EINTR. glibc docs for this is found here: - https://www.gnu.org/software/libc/manual/html_node/Interrupted-Primitives.html - - This last link says BSD doesn't have this "effect". Will there be a problem - if we do this unconditionally? - -Daniel (11 January 2005) -- Dan Torop cleaned up a few no longer used variables from David Phillips' - select() overhaul fix. - -- Cyrill Osterwalder posted a detailed analysis about a bug that occurs when - using a custom Host: header and curl fails to send a request on a re-used - persistent connection and thus creates a new connection and resends it. It - then sent two Host: headers. Cyrill's analysis was posted here: - https://curl.haxx.se/mail/archive-2005-01/0022.html - -- Bruce Mitchener identified (bug report #1099640) the never-ending SOCKS5 - problem with the version byte and the check for bad versions. Bruce has lots - of clues on this, and based on his suggestion I've now removed the check of - that byte since it seems to be able to contain 1 or 5. - -Daniel (10 January 2005) -- Pavel Orehov reported memory problems with the multi interface in bug report - #1098843. In short, a shared DNS cache was setup for a multi handle and when - the shared cache was deleted before the individual easy handles, the latter - cleanups caused read/writes to already freed memory. - -- Hzhijun reported a memory leak in the SSL certificate code, that leaked the - remote certificate name when it didn't match the used host name. - -Gisle (8 January 2005) -- Added Makefile.Watcom files (src/lib). Updated Makefile.dist. - -Daniel (7 January 2005) -- Improved the test script's valgrind log parser to actually work! Also added - the ability to disable the log scanner for specific test cases. Test case - 509 results in numerous problems and leaks in OpenSSL and has to get it - disabled. - -Daniel (6 January 2005) -- Fixed a single-byte read out of bounds in test case 39 in the curl tool code - (i.e not in the library). - -- Bug report #1097019 identified a problem when doing -d "data" with -G and - sending it to two URLs with {}. Added test 199 to verify the fix. - -Daniel (4 January 2005) -- Marty Kuhrt adjusted a VMS build script slightly - -- Kai Sommerfeld and Gisle Vanem fixed libcurl to build with IPv6 support on - Win2000. - -Daniel (2 January 2005) -- Alex Neblett updated the MSVC makefiles slightly. -Daniel (25 December 2004) -- Removed src/config.h.in from CVS, it is now copied from the (generated) - lib/config.h.in instead, as they can very well be the same. This removes a - "manual hassle". You may want to re-run buildconf now. - -- Werner Koch filed Debian bug report #286794, mentioning that curl contained - non-free (by Debian's view) source code. This was Angus Mackay's - src/getpass.c source code. I tried to contact him about it to quickly solve - this issue, but his email addresses bounce and I got some time "over" and - reimplemented the functionality once brought by Angus. We no longer use any - of Angus' original code and the new function is much simpler (IMO). Issue - solved. - -Daniel (24 December 2004) -- David Shaw added --protocols to curl-config, so that it now lists all - protocols libcurl was built to support. --feature no longer lists disabled - protocols. - -Daniel (23 December 2004) -- David Shaw fixed the configure --disable-[protocol] variables so that - curl-config --feature now works correctly! - -Daniel (22 December 2004) -- Rune Kleveland fixed a minor memory leak for received cookies with the - (rare) version attribute set. - -- Marcin Konicki provided two configure fixes and a source fix to make curl - build out-of-the-box on BeOS. - -Daniel (21 December 2004) -- Added test case 217 that verified CURLINFO_HTTP_CONNECTCODE, and I made the - -w option support 'http_connect' to make it easier to verify! - -- Fixed lib/select.c include order to build fine on FreeBSD - -- Fixed failf()'s reuse of the va_list variable that crashed on FreeBSD. - Pointed out by Peter Pentchev. - -Version 7.12.3 (20 December 2004) - -Daniel (19 December 2004) -- I investigated our PKCS12 build problem on Solaris 2.7 with OpenSSL 0.9.7e, - and it turned out to be the fault of the zlib 1.1.4 headers doing a typedef - named 'free_func' and the OpenSSL headers have a prototype that uses - 'free_func' in one of its arguments. This is why the compile errors out. - - In other words, we need to include the openssl/pkcs12.h header before the - zlib.h header and it builds fine. The configure script now checks for this - file and it then gets included early in lib/urldata.h. - -Daniel (18 December 2004) -- Samuel Listopad added support for PKCS12 formatted certificates. - -- Samuel Listopad fixed -E to support "C:/path" (with forward slash) as well. - -Daniel (16 December 2004) -- Gisle found and fixed a problem in the directory re-use for FTP. - - I added test case 215 and 216 to better verify the functionality. - -- Dinar in bug report #1086121, found a file handle leak when a multipart - formpost (including a file upload part) was aborted before the whole file - was sent. - -Daniel (15 December 2004) -- Tom Lee found out that globbing of strings with backslashes didn't work as - you'd expect. Backslashes are such a central part of windows file names that - forcing backslashes to have to be escaped with backslashes is a bit too - awkward to users. Starting now, you only need to escape globbing characters - such as the five letters: "[]{},". Added test case 214 to verify this. - -Daniel (14 December 2004) -- Harshal Pradhan patched a HTTP persistent connection flaw: if the user name - and/or password were modified between two requests on a persistent - connection, the second request were still made with the first setup! - - I added test case 519 to verify the fix. - -Daniel (13 December 2004) -- Gisle added CURLINFO_SSL_ENGINES to curl_easy_getinfo() to allow an app - to list all available crypto ENGINES. - -- Gisle fixed bug report #1083542, which pointed out a problem with resuming - large file (>4GB) file:// transfers on windows. - -Daniel (11 December 2004) -- Made the test suite HTTP server (sws) capable of using IPv6, and then - extended the test environment to support that and also added three test - cases (240, 241, 242) that run tests using IPv6. Test 242 uses a URL that - didn't work before the 10 dec fix by Kai Sommerfeld. - -- Made a failed file:// resume output an error message - -- Corrected the CURLE_BAD_DOWNLOAD_RESUME error message in lib/strerror.c - -- Dan Fandrich: - - simplified and consolidated the SSL checks in configure and the usage of the - defines in lib/setup.h - - provided a first libcurl.pc.in file for pkg-config (but the result is not - installed anywhere at this point) - - extended the cross compile section in the docs/INSTALL file - -Daniel (10 December 2004) -- When providing user name in the URL and a IPv6-style IP-address (like in - "ftp://user@[::1]/tmp"), the URL parser didn't get the host extracted - properly. Reported and fixed by Kai Sommerfeld. - -Daniel (9 December 2004) -- Ton Voon provided a configure fix that should fix the notorious (mostly - reported on Solaris) problem where the size_t check fails due to the SSL - libs being found in a dir not searched through by the run-time linker. - patch-tracker entry #1081707. - -- Bryan Henderson pointed out in bug report #1081788 that the curl-config - --vernum output wasn't zero prefixed properly (as claimed in documentation). - This is fixed in maketgz now. - -Daniel (8 December 2004) -- Matt Veenstra updated the mach-O framework files for Mac OS X. - -- Rene Bernhardt found and fixed a buffer overrun in the NTLM code, where - libcurl always and unconditionally overwrote a stack-based array with 3 zero - bytes. This is not an exploitable buffer overflow. No need to get alarmed. - -Daniel (7 December 2004) -- Fixed so that the final error message is sent to the verbose info "stream" - even if no errorbuffer is set. - -Daniel (6 December 2004) -- Dan Fandrich added the --disable-cookies option to configure to build - libcurl without cookie support. This is mainly useful if you want to build a - minimalistic libcurl with no cookies support at all. Like for embedded - systems or similar. - -- Richard Atterer fixed libcurl's way of dealing with the EPSV - response. Previously, libcurl would re-resolve the host name with the new - port number and attempt to connect to that, while it should use the IP from - the control channel. This bug made it hard to EPSV from an FTP server with - multiple IP addresses! - -Daniel (3 December 2004) -- Bug report #1078066: when a chunked transfer was pre-maturely closed exactly - at a chunk boundary it was not considered an error and thus went unnoticed. - Fixed by Maurice Barnum. - - Added test case 207 to verify. - -Daniel (2 December 2004) -- Fixed the CONNECT loop to default timeout to 3600 seconds. - - Added test case 206 that makes CONNECT with Digest. - - Fixed a flaw that prepended "(nil)" to the initial CONNECT rqeuest's user- - agent field. - -Daniel (30 November 2004) -- Dan Fandrich's fix for libz 1.1 and "extra field" usage in a gzip stream - -- Dan also helped me with input data to create three more test cases for the - --compressed option. - -Daniel (29 November 2004) -- I improved the test suite to enable binary contents in the tests (by proving - it base64 encoded), like for testing decompress etc. Added test 220 and 221 - for this purpose. Tests can now also depend on libz to run. - -- As reported by Reinout van Schouwen in Mandrake's bug tracker bug 12285 - (http://qa.mandrakesoft.com/show_bug.cgi?id=12285), when connecting to an - IPv6 host with FTP, --disable-epsv (or --disable-eprt) effectively disables - the ability to transfer a file. Now, when connected to an FTP server with - IPv6, these FTP commands can't be disabled even if asked to with the - available libcurl options. - -Daniel (26 November 2004) -- As reported in Mandrake's bug tracker bug 12289 - (http://qa.mandrakesoft.com/show_bug.cgi?id=12289), curl would print a - newline to "finish" the progress meter after each redirect and not only - after a completed transfer. - -Daniel (25 November 2004) -- FTP improvements: - - If EPSV, EPRT or LPRT is tried and doesn't work, it will not be retried on - the same server again even if a following request is made using a persistent - connection. - - If a second request is made to a server, requesting a file from the same - directory as the previous request operated on, libcurl will no longer make - that long series of CWD commands just to end up on the same spot. Note that - this is only for *exactly* the same dir. There is still room for improvements - to optimize the CWD-sending when the dirs are only slightly different. - - Added test 210, 211 and 212 to verify these changes. Had to improve the - test script too and added a new primitive to the test file format. - -Daniel (24 November 2004) -- Andrés García fixed the configure script to detect select properly when run - with Msys/Mingw on Windows. - -Daniel (22 November 2004) -- Made HTTP PUT and POST requests no longer use HEAD when doing multi-pass - auth negotiation (NTLM, Digest and Negotiate), but instead use the request - keyword "properly". Details in lib/README.httpauth. This also introduces - CURLOPT_IOCTLFUNCTION and CURLOPT_IOCTLDATA, to be used by apps that use the - "any" auth alternative as then libcurl may need to send the PUT/POST data - more than once and thus may need to ask the app to "rewind" the read data - stream to start. - - See also the new example using this: docs/examples/anyauthput.c - -- David Phillips enhanced test 518. I made it depend on a "feature" so that - systems without getrlimit() won't attempt to test 518. configure now checks - for getrlimit() and setrlimit() for this test case. - -Daniel (18 November 2004) -- David Phillips fixed libcurl to not crash anymore when more than FD_SETSIZE - file descriptors are in use. Test case 518 added to verify. - -Daniel (15 November 2004) -- To test my fix for the CURLINFO_REDIRECT_TIME bug, I added time_redirect and - num_redirects support to the -w writeout option for the command line tool. - -- Wojciech Zwiefka found out that CURLINFO_REDIRECT_TIME didn't work as - documented. - -Daniel (12 November 2004) -- Gisle Vanem modigied the MSVC and Netware makefiles to build without - libcurl.def - -- Dan Fandrich added the --disable-crypto-auth option to configure to allow - libcurl to build without Digest support. (I figure it should also explicitly - disable Negotiate and NTLM.) - -- *** Modified Behaviour Alert *** - - Setting CURLOPT_POSTFIELDS to NULL will no longer do a GET. - - Setting CURLOPT_POSTFIELDS to "" will send a zero byte POST and setting - CURLOPT_POSTFIELDS to NULL and CURLOPT_POSTFIELDSIZE to zero will also make - a zero byte POST. Added test case 515 to verify this. - - Setting CURLOPT_HTTPPOST to NULL makes a zero byte post. Added test case 516 - to verify this. - - CURLOPT_POSTFIELDSIZE must now be set to -1 to signal "we don't know". - Setting it to zero simply says this is a zero byte POST. - - When providing POST data with a read callback, setting the size up front - is now made with CURLOPT_POSTFIELDSIZE and not with CURLOPT_INFILESIZE. - -Daniel (11 November 2004) -- Dan Fandrich added --disable-verbose to the configure script to allow builds - without verbose strings in the code, to save some 12KB space. Makes sense - only for systems with very little memory resources. - -- Jeff Phillips found out that a date string with a year beyond 2038 could - crash the new date parser on systems with 32bit time_t. We now check for - this case and deal with it. - -Daniel (10 November 2004) -- I installed Heimdal on my Debian box (using the debian package) and noticed - that configure --with-gssapi failed to create a nice build. Fixed now. - -Daniel (9 November 2004) -- Gisle Vanem marked all external function calls with CURL_EXTERN so that now - the Windows, Netware and other builds no longer need libcurl.def or similar - files. - -Daniel (8 November 2004) -- Made the configure script check for tld.h if libidn was detected, since - libidn 0.3.X didn't have such a header and we don't work with anything - before libidn 0.4.1 anyway! Suse 9.1 apparently ships with a 0.3.X version - of libidn which makes the curl 7.12.2 build fail. Jean-Philippe - Barrette-LaPierre helped pointing this out. - -- Ian Gulliver reported in debian bug report #278691: if curl is invoked in an - environment where stderr is closed the -v output will still be sent to file - descriptor 2 which then might be the network socket handle! Now we have a - weird hack instead that attempts to make sure that file descriptor 2 is - opened (with a call to pipe()) before libcurl is called to do the transfer. - configure now checks for pipe() and systems without pipe don't get the weird - hack done. - -Daniel (5 November 2004) -- Tim Sneddon made libcurl send no more than 64K in a single first chunk when - doing a huge POST on VMS, as this is a system limitation. Default on general - systems is 100K. - -Daniel (4 November 2004) -- Andres Garcia made it build on mingw againa, my --retry code broke the build. - -Daniel (2 November 2004) -- Added --retry-max-time that allows a maximum time that may not have been - reached for a retry to be made. If not set there is no maximum time, only - the amount of retries set with --retry. - -- Paul Nolan provided a patch to make libcurl build nicely on Windows CE. - -Daniel (1 November 2004) -- When cross-compiling, the configure script no longer attempts to use - pkg-config on the build host in order to detect OpenSSL compiler options. - -Daniel (27 October 2004) -- Dan Fandrich: - - An improvement to the gzip handling of libcurl. There were two problems with - the old version: it was possible for a malicious gzip file to cause libcurl - to leak memory, as a buffer was malloced to hold the header and never freed - if the header ended with no file contents. The second problem is that the - 64 KiB decompression buffer was allocated on the stack, which caused - unexpectedly high stack usage and overflowed the stack on some systems - (someone complained about that in the mailing list about a year ago). - - Both problems are fixed by this patch. The first one is fixed when a recent - (1.2) version of zlib is used, as it takes care of gzip header parsing - itself. A check for the version number is done at run-time and libcurl uses - that feature if it's present. I've created a define OLD_ZLIB_SUPPORT that - can be commented out to save some code space if libcurl is guaranteed to be - using a 1.2 version of zlib. - - The second problem is solved by dynamically allocating the memory buffer - instead of storing it on the stack. The allocation/free is done for every - incoming packet, which is suboptimal, but should be dwarfed by the actual - decompression computation. - - I've also factored out some common code between deflate and gzip to reduce - the code footprint somewhat. I've tested the gzip code on a few test files - and I tried deflate using the freshmeat.net server, and it all looks OK. I - didn't try running it with valgrind, however. - -- Added a --retry option to curl that takes a numerical option for the number - of times the operation should be retried. It is retried if a transient error - is detected or if a timeout occurred. By default, it will first wait one - second between the retries and then double the delay time between each retry - until the delay time is ten minutes which then will be the delay time - between all forthcoming retries. You can set a static delay time with - "--retry-delay [num]" where [num] is the number of seconds to wait between - each retry. - -Daniel (25 October 2004) -- Tomas Pospisek filed bug report #1053287 that proved -C - and --fail on a - file that was already completely downloaded caused an error, while it - doesn't if you don't use --fail! I added test case 194 to verify the fix. - Grrr. CURLOPT_FAILONERROR is now added to the list stuff to remove in - libcurl v8 due to all the kludges needed to support it. - -- Mohun Biswas found out that formposting a zero-byte file didn't work very - good. I fixed. - -Daniel (19 October 2004) -- Alexander Krasnostavsky made it possible to make FTP 3rd party transfers - with both source and destination being the same host. It can be useful if - you want to move a file on a server or similar. - -- Guillaume Arluison added CURLINFO_NUM_CONNECTS to allow an app to figure - out how many new connects a previous transfer required. - - I added %{num_connects} to the curl tool and added test case 192 and 193 - to verify the new code. - -Daniel (18 October 2004) -- Peter Wullinger pointed out that curl should call setlocale() properly to - initiate the specific language operations, to make the IDN stuff work - better. - -Version 7.12.2 (18 October 2004) - -Daniel (16 October 2004) -- Alexander Krasnostavsky made the CURLOPT_FTP_CREATE_MISSING_DIRS option work - fine even for third party transfers. - -- runekl at opoint.com found out (and provided a fix) that libcurl leaked - memory for cookies with the "max-age" field set. - -Gisle (16 October 2004) -- Issue 50 in TODO-RELEASE; Added Traian Nicolescu's patches for threaded - resolver on Windows. Plugged some potential handle and memory leaks. - -Daniel (14 October 2004) -- Eric Vergnaud pointed out that libcurl didn't treat ?-letters in the user - name and password fields properly in URLs, like - ftp://us?er:pass?word@site.com/. Added test 191 to verify the fix. - -Daniel (11 October 2004) -- libcurl now uses SO_NOSIGPIPE for systems that support it (Mac OS X 10.2 or - later is one) to inhibit the SIGPIPE signal when writing to a socket while - the peer dies. The same effect is provide by the MSG_NOSIGNAL parameter to - send() on other systems. Alan Pinstein verified the fix. - -Daniel (10 October 2004) -- Systems with 64bit longs no longer use strtoll() or our strtoll- replacement - to parse 64 bit numbers. strtol() works fine. Added a configure check to - detect if [constant]LL works and if so, use that in the strtoll replacement - code to work around compiler warnings reported by Andy Cedilnik. - -Gisle (6 October 2004) -- For USE_LIBIDN builds: Added Top-Level-Domain (TLD) check of host-name - used in fix_hostname(). Checks if characters in 'host->name' (indirectly - via 'ace_hostname') are legal according to the TLD tables in libidn. - -Daniel (6 October 2004) -- Chih-Chung Chang reported that if you use CURLOPT_RESUME_FROM and enabled - CURLOPT_FOLLOWLOCATION, libcurl reported error if a redirect happened even - if the new URL would provide the resumed file. Test case 188 added to verify - the fix (together with existing test 99). - -- Dan Fandrich fixed a configure flaw for systems that need both nsl and socket - libs to use gethostbyname(). - -- Removed tabs and trailing whitespace from lots of source files. - -Daniel (5 October 2004) -- Made configure --with-libidn=PATH try the given PATH before the default - paths to make it possible to override. - -- If idna_strerror() is present in libidn, we can use that instead of our - internal replacement. This function was added by Simon in libidn 0.5.6 and - is detected by configure. - -- It seems basename() on IRIX is in the libgen library and since we don't use - that, configure finds libgen.h but not basename and then we get a compiler - error because our basename() replacement doesn't match the proto in - libgen.h. Starting now, we don't include the file if basename wasn't found - as well. - -Daniel (4 October 2004) -- Chris found a race condition resulting in CURLE_COULDNT_RESOLVE_HOST and - potential crash, in the windows threaded name resolver code. - -Daniel (3 October 2004) -- Replaced the use of isspace() in cookie.c with our own version instead since - we have most data as 'char *' and that makes us pass in negative values if - there is 8bit data in the string. Changing to unsigned causes too much - warnings or too many required typecasts to the normal string functions. - Harshal Pradhan identified this problem. - -Daniel (2 October 2004) -- Bertrand Demiddelaer found a case where libcurl could read already freed - data when CURLOPT_VERBOSE is used and a (very) persistent connection. It - happened when the dns cache entry for the connection was pruned while the - connection was still alive and then again re-used. We worked together on - this fix. - -- Gisle Vanem provided code that displays an error message when the (libidn - based) IDN conversion fails. This is really due to a missing suitable - function in the libidn API that I hope we can remove once libidn gets a - function like this. - -Daniel (1 October 2004) -- Aleksandar Milivojevic reported a problem in the Redhat bugzilla (see - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=134133) and not to - anyone involved in the curl project! This happens when you try to curl a - file from a proftpd site using SSL. It seems proftpd sends a somewhat - unorthodox response code (232 instead of 230). I relaxed the response code - check to deal with this and similar cases. - -- Based on Fedor Karpelevitch's formpost path basename patch, file parts in - formposts no longer include the path part. If you _really_ want them, you - must provide your preferred full file name with CURLFORM_FILENAME. - - Added detection for libgen.h and basename() to configure. My custom - basename() replacement function for systems without it, might be a bit too - naive... - - Updated 6 test cases to make them work with the stripped paths. - -Daniel (30 September 2004) -- Larry Campbell added CURLINFO_OS_ERRNO to curl_easy_getinfo() that allows an - app to retrieve the errno variable after a (connect) failure. It will make - sense to provide this for more failures in a more generic way, but let's - start like this. - -- Günter Knauf and Casey O'Donnell worked out an extra #if condition for the - curl/multi.h header to work better in winsock-using apps. - -- Jean-Philippe Barrette-LaPierre made buildconf run better on Mac OS X by - properly using glibtoolize instead of plain libtoolize. (This is made if - glibtool was found and used instead of plain libtool.) - -Daniel (29 September 2004) -- Bertrand Demiddelaer fixed curl_easy_reset() so that it doesn't mistakingly - enable the progress meter. - -Daniel (28 September 2004) -- "Mekonikum" found out that if you built curl without SSL support, although - your current SSL installation supports Engine, the compile fails. - -Daniel (27 September 2004) -- When --with-ssl=PATH is used to the configure script, it no longer uses - pkg-config to figure out extra details. That is now only done if no PATH is - included or if SSL is checked for by default without the --with-ssl option. - -Daniel (25 September 2004) -- Peter Sylvester pointed out that CURLOPT_SSLENGINE couldn't even be set to - NULL when no engine was supported. It can now. - -Daniel (22 September 2004) -- Dan Fandrich fixed three test cases to no longer use "localhost" but instead - use "127.0.0.1" to avoid requiring that localhost resolves nicely. - -- Jean-Claude Chauve fixed an LDAP crash when more than one record was - retrieved. - -Daniel (19 September 2004) -- Andreas Rieke pointed out that when attempting to connect to a host without - a service on the specified port, curl_easy_perform() didn't properly provide - an error message in the CURLOPT_ERRORBUFFER buffer. - -Daniel (16 September 2004) -- Daniel at touchtunes uses the FTP+SSL server "BSDFTPD-SSL from - http://bsdftpd-ssl.sc.ru/" which accordingly doesn't properly work with curl - when "AUTH SSL" is issued (although the server responds fine and everything) - but requires that curl issues "AUTH TLS" instead. See - https://curl.haxx.se/feedback/display.cgi?id=10951944937603&support=yes - - Introducing CURLOPT_FTPSSLAUTH that allows the application to select which - of the AUTH strings to attempt first. - -- Anonymous filed bug report #1029478 which identified a bug when you 1) used - a URL without properly seperating the host name and the parameters with a - slash. 2) the URL had parameters to the right of a ? that contains a slash - 3) curl was told to follow Location:s 4) the request got a response that - contained a Location: to redirect to "/dir". curl then appended the new path - on the wrong position of the original URL. - - Test case 187 was added to verify that this was fixed properly. - -Daniel (11 September 2004) -- Added parsedate.c that contains a rewrite of the date parser currently - provided by getdate.y. The new one is MUCH smaller and will allow us to run - away from the yacc/bison jungle. It is also slightly lacking in features - compared to the old one, but it supports parsing of all date formats HTTP - involves (and a fair bunch of others). - -Daniel (10 September 2004) -- As found out by Jonas Forsman, curl didn't allow -F to set Content-Type on - text-parts. Starting now, we can do -F "name=daniel;type=text/extra". Added - test case 186 to verify. - -- Bug report #1025986. When following a Location: with a custom Host: header - replacement, curl only replaced the Host: header on the initial request - and didn't replace it on the following ones. This resulted in requests with - two Host: headers. - - Now, curl checks if the location is on the same host as the initial request - and then continues to replace the Host: header. And when it moves to another - host, it doesn't replace the Host: header but it also doesn't make the - second Host: header get used in the request. - - This change is verified by the two new test cases 184 and 185. - -Daniel (8 September 2004) -- Modified the test suite to be able to use and run with customized port - numbers. This was always intended but never before possible. Now a simple - change in the runtests.pl script can make all tests use different ports. - The default ports in use from now on are 8990 to 8993. - -Daniel (2 September 2004) -- Minor modification of an SSL-related error message. - -Daniel (31 August 2004) -- David Tarendash found out that curl_multi_add_handle() returned - CURLM_CALL_MULTI_PERFORM instead of CURLM_OK. - -Daniel (30 August 2004) -- Make "Proxy-Connection: close" close the current proxy connection, as Roman - Koifman found out. - -Daniel (24 August 2004) -- Fixed a getdate problem by post-replacing the getdate.c file after the - bison/yacc process to add the fix Harshal Pradhan suggested. The problem - caused a crash on Windows when parsing some dates. - -Daniel (23 August 2004) -- Roman Koifman pointed out that libcurl send Expect: 100-continue on POSTs - even when told to use HTTP 1.0, which is not correct. Test case 180 and - 181 verify this. - -- Added test case 182 to verify that zero byte transfers call the callback - properly. - -Daniel (20 August 2004) -- Alexander Krasnostavsky made the write callback get called even when a zero - byte file is downloaded. - -Daniel (18 August 2004) -- Ling Thio pointed out that when libcurl is built IPv6-enabled, it still did - reverse DNS lookups when fed with a numerical IP-address (like - http://127.0.0.1/), although it doesn't when built IPv6-disabled. libcurl - should never do reverse lookups. - -Daniel (17 August 2004) -- Kjetil Jacobsen noticed that when transferring a file:// URL pointing to an - empty file, libcurl would return with the file still open. - -- Alexander Krasnostavsky pointed out that the configure script needs to define - _THREAD_SAFE for AIX systems to make libcurl built really thread-safe. - - Also added a check for the xlc compiler on AIX, and if that is detect we use - the -qthreaded compiler option - -Daniel (16 August 2004) -- libcurl now allows a custom "Accept-Encoding:" header override the - internally set one that gets set with CURLOPT_ENCODING. Pointed out by Alex. - -- Roland Krikava found and fixed a cookie problem when using a proxy (the - path matching was wrong). I added test case 179 to verify that we now do - right. - -Daniel (15 August 2004) -- Casey O'Donnell fixed some MSVC makefile targets to link properly. - -Daniel (11 August 2004) -- configure now defines _XOPEN_SOURCE to 500 on systems that need it to build - warning-free (the only known one so far is non-gcc builds on 64bit SGI - IRIX). (Reverted this change later as it caused compiler errors.) - -- the FTP code now includes the server response in the error message when the - server gives back a 530 after the password is provided, as it isn't - necessary because of a bad user name or password. - -Version 7.12.1 (10 August 2004) - -Daniel (10 August 2004) -- In OpenSSL 0.9.7d and earlier, ASN1_STRING_to_UTF8 fails if the input is - already UTF-8 encoded. This made the certificate verification fail if the - remote server used a certificate with the name UTF-8 encoded. - - Work-around brought by Alexis S. L. Carvalho. - -Daniel (9 August 2004) -- I fixed the configure script for krb4 to use -lcom_err as well, as I started - to get link problems with it unless I did that on my Solaris 2.7 box. I - don't understand why I started to get problems with this now! - -Daniel (5 August 2004) -- Enrico Scholz fixed the HTTP-Negotiate service name to be uppercase as - reported in bug report #1004105 - -Daniel (4 August 2004) -- Gisle Vanem provided a fix for the multi interface and connecting to a host - using multiple IP (bad) addresses. - -- Dylan Salisbury made libcurl no longer accept cookies set to a TLD only (it - previously allowed that on the seven three-letter domains). - -Daniel (31 July 2004) -- Joel Chen reported that the digest code assumed quotes around the contents a - bit too much. - -Daniel (28 July 2004) -- Bertrand Demiddelaer fixed the host name to get setup properly even when a - connection is re-used, when a proxy is in use. Previously the wrong Host: - header could get sent when re-using a proxy connection to a different target - host. - -- Fixed Brian Akins' reported problems with duplicate Host: headers on re-used - connections. If you attempted to replace the Host: header in the second - request, you got two such headers! - -- src/Makefile.am now includes the Makefile.inc file to get info about files - -Daniel (26 July 2004) -- Made "curl [URL] -o name#2" work as expected. If there's no globbing for the - #-number, it will simply be used as #2 in the file name. - -- Bertrand Demiddelaer fixed testing with valgrind 2.1.x and added two missing - newlines in the cookie informationals. - -Daniel (24 July 2004) -- I fixed the autobuilds with ares, since they now need to have buildconf run - in the ares dir before the configure script is run. - -- Added Casey O'Donnell's curl_easy_reset() function. It has a proto in - curl/curl.h but we have no man page yet. - -Daniel (20 July 2004) -- Added buildconf and buildconf.bat to the release archives, since they are - handy for rebuilding curl when using a daily snapshot (and not a pure CVS - checkout). - -Daniel (16 July 2004) -- As suggested by Toby Peterson, libcurl now ignores Content-Length data if the - given size is a negative number. Test case 178 verifies this. - -Daniel (14 July 2004) -- Günter Knauf has made the Netware builds do without the config-netware.h - files, so they are now removed from the dist packages. - -- Günter Knauf made curl and libcurl build with Borland again. - -- Andres Garcia fixed the common test 505 failures on windows. - -Daniel (6 July 2004) -- Andrés García found out why the windows tests failed on file:// "uploads". - -Daniel (2 July 2004) -- Andrés García reported a curl_share_cleanup() crash that occurs when no - lock/unlock callbacks have been set and the share is cleaned up. - -Daniel (1 July 2004) -- When using curl --trace or --trace-ascii, no trace messages that were sent - by curl_easy_cleanup() were included in the trace file. This made the - message "Closing connection #0" never appear in trace dumps. - -Daniel (30 June 2004) -- Niels van Tongeren found that setting CURLOPT_NOBODY to TRUE doesn't disable - a previously set POST request, making a very odd request get sent (unless - you disabled the POST) a HEAD request with a POST request-body. I've now - made CURLOPT_NOBODY enforce a proper HEAD. Added test case 514 for this. - -Daniel (29 June 2004) -- Günter Knauf made the testcurl.pl script capable of using a custom setup - file to easier run multiple autobuilds on the same source tree. - -- Gisle fixed the djgpp build and fixed a memory problem in some of the - reorged name resolved code. - -- Fixed code to allow connects done using the multi interface to attempt the - next IP when connecting to a host that resolves to multiple IPs and a - connect attempt fails. - -Daniel (27 June 2004) -- Based on Rob Stanzel's bug report #979480, I wrote a configure check that - checks if poll() can be used to wait on NULL as otherwise select() should be - used to do it. The select() usage was also fixed according to his report. - - Mac OS X 10.3 says "poll() functionality for Mac OS X is implemented via an - emulation layer on top of select(), not in the kernel directly. It is - recommended that programs running under OS X 10.3 prefer select() over - poll(). Configure scripts should look for the _POLL_EMUL_H_ define (instead - of _POLL_H_ or _SYS_POLL_H_) and avoid implementations where poll is not - implemented in the kernel." - - Yes, we can probably use select() on most platforms but today I prefered to - leave the code unaltered. - -Daniel (24 June 2004) -- The standard curl_version() string now only includes version info about - involved libraries and not about particular features. Thus it will no longer - include info about IPv6 nor GSS. That info is of course still available in - the feature bitmask curl_version_info() offers. - -- Replaced all occurances of sprintf() with snprintf(). This is mostly because - it is "A Good Thing" rather than actually fixing any known problem. This - will help preventing future possible mistakes to cause buffer overflows. - -- Major reorganization in the host resolve code (again). This time, I've - modified the code to now always use a linked list of Curl_addrinfo structs - to return resolved info in, no matter what resolver method or support that - is available on the platform. It makes it a lot easier to write code that - uses or depends on resolved data. - - Internally, this means amongst other things that we can stop doing the weird - "increase buffer size until it works" trick when resolving hosts on - IPv4-only with gethostbyname_r(), we support socks even on libcurls built - with IPv6 enabled (but only to socks servers that resolve to an IPv4 - address) and we no longer deep-copy or relocate hostent structs (we create - Curl_addrinfo chains instead). - - The new "hostent to Curl_addrinfo" converter function is named Curl_he2ai() - and is slightly naive and simple, yet I believe it is functional enough to - work for libcurl. - -Daniel (22 June 2004) -- David Cohen pointed out that RFC2109 says clients should allow cookies to - contain least 4096 bytes while libcurl only allowed 2047. I raised the limit - to 4999 now and made the used buffer get malloc()ed instead of simply - allocated on stack as before. Extended test case 46 to include a cookie with - very huge content to verify the fix. - -- Günter Knauf fixed getdate.y to remove a few warnings. I removed the - ifdef'ed test we never ever use anyway. - -- Gisle Vanem fixed the certificate wildcard checks to support a '*'-letter - anywhere in the wildcard string, support multiple '*'-letters in the - wildcard and to allow the '*'-letter to match a string that includes a dot. - -Daniel (21 June 2004) -- testcurl.sh is now removed completely, tests/testcurl.pl is the script to - use when autobuilding curl! - -- Kjetil Jacobsen brought my attention to the fact that you cannot properly - abort an upload with the readfunction callback, since returning 0 or -1 only - stops the upload and libcurl will continue waiting for downloaded data and - the server often waits for the rest of the upload data to arrive. - - Thus, I've now added the ability for read callbacks to return - CURL_READFUNC_ABORT to abort an upload from a read callback. This will stop - the transfer immediately with a CURLE_ABORTED_BY_CALLBACK return code. - - Test case 513 was added to verify that it works. I had to improve the test - HTTP server too to dump the request to a file even when the client - disconnects prematurely. - -Daniel (19 June 2004) -- Luca Alteas provided a test case with a failing curl operation: when we POST - to a site with --digest (or similar) set, and the server responded with a 302 - Location: to the "authprobe" request, it was not treated correctly. We still - will behave badly if FOLLOWLOCATION is enabled for this case, but I'm not - in the mood to dive into this right now and will leave it as-is for now. - Verified my fix with test case 177. - -Daniel (18 June 2004) -- Gisle Vanem's patch that provides more details from the SSL layers (if you - use an OpenSSL version that supports it). It also introduces two new types - of data that can be sent to the debug callback: CURLINFO_SSL_DATA_IN and - CURLINFO_SSL_DATA_OUT. - -- With David Byron's test server I could repeat his problem and make sure that - POSTing over HTTPS:// with NTLM works fine now. There was a general problem - with multi-pass authentication with non-GET operations with CONNECT. - -Daniel (16 June 2004) -- Modified to keep the upload byte counter in an curl_off_t, not an int as - before. 32bits is not enough. This is most likely the bug Jean-Louis Lemaire - reported that makes 2GB FTP uploads to report error ("unaligned file sizes") - when completed. - -Daniel (15 June 2004) -- Luca Alteas reported a problem that I fixed: if you did a POST with - CURLAUTH_DIGEST set but the server didn't require any authentication, - libcurl would repeatedly send HEAD lots of times until it gives up. This was - actually the case for all multi-pass authentications. Added test case 174, - 175 and 176 to verify this. - -Daniel (14 June 2004) -- Multipart formposts uploading files no longer inserts the files themselves - into the huge prebuilt chunk. This enables libcurl to formpost files that is - larger than the amount of system memory. When the file given is passed on - stdin, libcurl still uses the old method of reading the full fill before the - upload takes place. This approach was selected in order to not alter the - behavior for existing applications, as when using stdin libcurl can't know - the size of the upload and chunked transfer-encoding can only be used on - HTTP 1.1 servers. - -Daniel (13 June 2004) -- Gisle found out that we did wildcard cert name checks wrong, so that parts - of the check wrongly was case sensitive. - -Daniel (11 June 2004) -- Tim Sneddon brought a minor VMS fix to make curl build properly on his VMS - machine. He also had some interesting libcurl patches... they might be able - to do in a slightly nicer way. Discussions are in progress. - -Daniel (10 June 2004) -- Gisle Vanem brought code cleanupsm better verbose output and better connect - timeout handling when attempting to connect to a host that resolves to - multiple IP addresses. - -- Steven Bazyl and Seshubabu Pasam pointed out a bug on win32 when freeing the - path after a file:// transfer. - -Daniel (9 June 2004) -- Alexander Krasnostavsky made 'configure --disable-http' work to build libcurl - without HTTP support. I added a new return code for curl_formadd() in case - libcurl is built with HTTP disable: CURL_FORMADD_DISABLED. - -- Alexander Krasnostavsky pointed out a missing file in the generated - curllib.dsp file, and now people building with this should get a libcurl.lib - file generated as it used to do before we generated this file. - -Daniel (8 June 2004) -- Marty Kuhrt fixed a minor build problem for VMS. - -Daniel (7 June 2004) -- Reverted the configure check from the 4th since it obviously didn't work. - Remade it in a different manner that hopefully works better. - -Daniel (4 June 2004) -- Günter Knauf brought patches to make curl build fine on NetWare again. - -- Made the configure checks for strerror_r() not exit the configure script - when built for cross-compiling. - -Daniel (3 June 2004) -- Chris Gaukroger pointed out that 'make test' attempts to run the tests even - if curl is built cross-compiled. I've now made it output a short message - instead, saying it isn't possible to do. - -- Alexander Krasnostavsky brought FTP 3rd party transfer support to libcurl. - You can now use libcurl to transfer files between two remote hosts using - FTP. There are a bunch of new options to control this with: - CURLOPT_SOURCE_HOST - CURLOPT_SOURCE_USERPWD - CURLOPT_SOURCE_PATH - CURLOPT_SOURCE_PORT - CURLOPT_PASV_HOST - CURLOPT_SOURCE_PREQUOTE - CURLOPT_SOURCE_POSTQUOTE - - (They still remain to be documented properly in the curl_easy_setopt man - page.) - - When using this, the ordinary CURLOPT_URL specifies the target URL, and you - specify the source data with these additional options. ftp3rdparty.c is a - new example source code showing how to use this. - -- Vincent Bronner fixed the HTTP Digest code to use the proxy user name and - password when doing proxy authentication, it previously always used the host - user name and password! - -Daniel (2 June 2004) -- CURLOPT_UPLOAD and CURLOPT_PUT now do the exact same thing internally, which - fixes some old confusions on when which of these should be used and what the - differences are. - -- Applied Gisle's fixes to make curl build fine with lcc-win32 - -Version 7.12.0 (2 June 2004) - -Daniel (1 June 2004) -- I clarified the --create-dirs option somewhat in the curl man page. - -- Renaud Duhaut corrected the curl_unescape man page. - -- David Byron modified one of Massimiliano Ziccardi's recent MSVC makefile - changes to now again use the mm lib by default. - -Daniel (26 May 2004) -- Mohun Biswas added release-zlib and debug-zlib targets to the MSVC libcurl - Makefile - -- David Byron reported a problem with proxy authentication when doing CONNECT, - like when accessing HTTPS sites wiht a proxy. This probably broke when I - rewrote the auth stuff recently. - -- I added fileupload.c in the examples directory, showing how an upload to a - file:// URL is made. - -Daniel (25 May 2004) -- Massimiliano Ziccardi updated the MSVC makefiles. - -Daniel (24 May 2004) -- libcurl now supports "uploading" to file:// URLs. Test 204 and 205 were - added to verify. - -- Simon Josefsson added a idn_free() function in libidn 0.4.5 as a reaction to - Gisle's previous mail. We now use this function, and thus we require libidn - 0.4.5 or later. No earlier version will do. - -- Robert D. Young reported that CURLOPT_COOKIEFILE and CURLOPT_COOKIE could - not be used both in one request. Fixed it and added test case 172 to verify. - -Daniel (21 May 2004) -- While talking to host a.b.c, libcurl did wrongly not accept cookies that - were set to the domain .a.b.c (that is with a dot prefix). This is now fixed - and test case 171 verifies it. - -Daniel (20 May 2004) -- Jesse Noller reported that the upload speed info reported by libcurl was - wrong. The same was true for the download speed. Fixed now. - -Daniel (19 May 2004) -- David Byron added test case 170 - this used to crash the previous version of - curl. - -Daniel (17 May 2004) -- Peter Sylvester's patch that addresses two flaws in the peer certificate - name verification: - o when multiple common names are used (as in the curl tests), the last name - needs to be selected. - o allow comparing with encoded values, at least with BMP and ISO latin1 - encoded T61strings. - -- All 191 test cases run through the torture test OK! 'make test-torture' is - now available in the root makefile (on configure-based environments). - -Daniel (14 May 2004) -- With a slightly modified ftpserver.pl I've now run almost all tests through - with runtests.pl -t. This is goodness! - -- Since I have been unable to contact the CVS admins for several months, I've - decided that the current CVS hosting was not good enough. I've now moved the - CVS repo once again, see README for updated cvs checkout instructions. - -Daniel (13 May 2004) -- runtests.pl -t now runs fine all the way to test 100. I believe test case - 100 fails because of an FTP server problem. - -Daniel (12 May 2004) -- General cleanups all over to make libcurl survive and do well when a memory - function returns NULL. runtests.pl -t now works fine for the first 26 test - cases. - -Daniel (11 May 2004) -- Seshubabu Pasam provided a patch that introduces curl_global_init_mem() - - like normal curl_global_init() but allows the app to replace all memory - functions with its own set. I modified it slightly. - -- Based on Luca Alteas' comments, I modified the curllib.dsp generation code. - -Daniel (10 May 2004) -- Gisle mailed Simon Josefsson (of libidn fame) about the benefits of a - separate free()-function by that lib to make sure the memory is freed by the - same memory subsystem that allocated it. He responded positively and this - will likely cause us to require a newer version of libidn as soon as Simon - releases one with such a libidn_free() function. - -- James Bursa made runtests.pl's -t option work for any given test case, and I - edited to allow -g too. Not even test case 1 worked... - -- Luca Altea made the nc= field not use quotes in outgoing HTTP Digest headers. - -- Andrés García fixed a problem in the test script that made it fail to - recognize our own running HTTP server. - -Daniel (7 May 2004) -- James Bursa fixed the memanalyze.pl script to conder malloc(0) areas OK to - free() and he made two failed-resolve error messages use the new display- - name instead of the internally-used name. - -- Gisle Vanem tried curl with - www.etdomenenavnkanmaksimaltinneholdesekstitrebokstaversliksomdette.com - which caused problems, and I fixed the single zero byte buffer overwrite - that occurred (due to a stupid protocol buffer size and parser). - -- Made the lib/curllib.dsp file get generated automaticly when a distribution - package is made, with the msvcproj.* files as templates and all - win32-sources added. I think this can be made to work better than the always - lagging-behind previous approach. I'm not sure this builds a working project - file right now though! - -Daniel (6 May 2004) -- Michael Benedict brought a fix that fills in the errorbuffer properly when - ares fails to resolve a name for a case not previously dealt with like this. - -Daniel (5 May 2004) -- Joe Halpin fixed the annoying typecast warning in lib/ldap.c - -- Gisle Vanem fixes: - o memdebug to not access NULL on several places - o libcurl.def; curl_formparse is gone. - o progress.c; fixed the percent values being trunced to 0. - o if2ip.*; constified the 'interface' argument. - -- Tor Arntsen reported that many of his autobuilds froze and I found and fixed - a problem introduced with the HTTP auth overhaul that could lead to a - never-ending internal request-loop due to un-initialized variables! - -- Removed several compiler warnings on various compilers/platforms. - -Daniel (4 May 2004) -- curl_formparse() has been removed from the library. It has been marked and - mentioned as deprecated for several years. - -Daniel (3 May 2004) -- Rewritten HTTP authentication code. The previous code could not properly - deal with the added test cases 167, 168 and 169. I've now rewritten the code - to better separate host and proxy authentication and not re-use the same - variables as much as before as it proved non working in the more involved - cases. All the current tests run OK now, and so do the new ones. The curl - tool got a new option named --proxy-digest to enable HTTP Digest - authentication with the proxy. I also made the library support it. - -- Gisle Vanem made the LDAP code work with wldap32.dll as supplied with - Win-98/ME/2000/XP, so no extra .dlls are required when curl/libcurl is used - on these Windows versions. - -Daniel (30 April 2004) -- runtests.pl now scans the valgrind log for valgrind-detected memory leaks - after each test case if valgrind was found and used. - -- I modified the app-code in curl to include the new lib/curlx.h and only - access those functions using the curlx_-prefix in preparation for the future - removal of several curl_-functions from the public libcurl API. - -- Introduced lib/curlx.h as a single header to provide the curlx_-functions - to apps. - -- Added notices in the man pages for curl_getenv, curl_mprintf, curl_strequal - and curl_strnequal that they are subject for removal in a future release. - STOP USING THESE FUNCTIONS. - -- Mihai Ionescu noticed he couldn't do formposts with whitespace in the file - names and yes, I broke that on April 23. Sigh. I fixed it now and added - test case 166 to verify it. - -- Luca Altea pointed out a mistake left from the Digest patch of yesterday. - -Daniel (29 April 2004) -- Made IDN domains work when sending requsts over HTTP proxy as well. Added - test case 165 to verify the functionality. - -- Fixed a bug in the new internal host name setup when re-using connections. - -- James Bursa found out that curl_easy_duphandle() with ares-built libcurl - created a bad handle that would crash in the first name resolve attempt. This - is now fixed and test case 512 was added to verify it. - -- Luca Altea provided a major HTTP Digest code fix and cleanup. We now follow - the Digest RFC a lot better. - -- Gisle Vanem made the SSL code use ERR_error_string_n() where applicable. - -Daniel (27 April 2004) -- I remodeled Gisle's IDN code slightly and now we convert both the host name - and proxy name to the ACE encoded version to use internally for resolves and - cookies etc. They are now using one 'struct hostname' each that keep both - the original name and the possibly encoded name. IDN resolves work for me - now using IPv6, IPv4 and ares resolving. Even cookies on IDN sites seem to - do right. I got some failures at first when CHARSET wasn't set at all which - confused libidn completely and it decided by encoding of choice was - 'ANSI_X3.4-1968'... - -- made 'configure --without-libidn' work - -Daniel (25 April 2004) -- Fixed the src/hugehelp.c file to include "setup.h" instead of "config.h" to - make the problems with USE_MANUAL on windows go away. - -- configure --without-ssl could still wrongly include some OpenSSL info in the - Makefiles if pkg-config had info about OpenSSL. Bug #941762 reported by - Martin. - -- Since we can now build and use quite a large set of 3rd party libraries, I - decided I would make configure produce a summary at the end showing what - libraries it uses and if not, what option to use to make it use that. I also - added some other random info that is nice in a "configure summary" output. - -- Applied TommyTam's patch that now make curl work with telnet and stdin - properly on Windows. - -- The changes for today below were made by me and Gisle Vanem. - - The file previously known as hostip.c has now undergone a huge cleanup and - split: - - hostip.c explained - ================== - - The main COMPILE-TIME DEFINES to keep in mind when reading the host*.c - source file are these: - - CURLRES_IPV6 - this host has getaddrinfo() and family, and thus we use - that. The host may not be able to resolve IPv6, but we don't really have to - take that into account. Hosts that aren't IPv6-enabled have CURLRES_IPV4 - defined. - - CURLRES_ARES - is defined if libcurl is built to use c-ares for asynchronous - name resolves. It cannot have ENABLE_IPV6 defined at the same time, as - c-ares has no IPv6 support. This can be Windows or *nix. - - CURLRES_THREADED - is defined if libcurl is built to run under (native) - Windows, and then the name resolve will be done in a new thread, and the - supported asynch API will be the same as for ares-builds. - - If any of the two previous are defined, CURLRES_ASYNCH is defined too. If - libcurl is not built to use an asynchronous resolver, CURLRES_SYNCH is - defined. - - The host*.c sources files are split up like this: - - hostip.c - method-independent resolver functions and utility functions - hostasyn.c - functions for asynchronous name resolves - hostsyn.c - functions for synchronous name resolves - hostares.c - functions for ares-using name resolves - hostthre.c - functions for threaded name resolves - hostip4.c - IPv4 specific functions - hostip6.c - IPv6 specific functions - - The hostip.h is the single united header file for all this. It defines the - CURLRES_* defines based on the config*.h and setup.h defines. - -- Added function header comments to many functions in an attempt to better - explain the purpose of them all. - -- configure --with-libidn is now supported. It makes the configure script - check for libidn libs and include files in the prefix path given. If you - say --with-libidn=/usr/local, it will check for the lib in /usr/local/lib - and the includes in /usr/local/include etc. - -- curl_version_info() now returns a struct aged CURLVERSION_THIRD including - libidn version info. The string curl_version() returns also includes libidn - version info, if available. - -Version 7.11.2 (26 April 2004) - -Daniel (25 April 2004) -- Erwin Authried pointed out that configure --disable-manual didn't do right - if you already had a src/hugehelp.c source file present (which most people - do I guess). It now uses the USE_MANUAL define properly. - -Daniel (23 April 2004) -- Gisle Vanem found and fixed a memory leak when doing (failing) Windows - threaded name resolves. - -- I also added test case 163 just to make sure -F "var=<file" works fine and - can pass on characters such as newlines, carriage-return and tabs. - -- When we added test case 162 without adding the necessary requirement field - in the test meta data we could see that curl didn't complain if you used - --proxy-ntlm even if the underlying libcurl it uses has no NTLM support! I - now made it check this first, and it now exists with a "the installed - libcurl version doesn't support this" message if it happens again. - -Daniel (22 April 2004) -- David Byron found and fixed a small bug with the --fail and authentication - stuff added a few weeks ago. Turns out that if you specify --proxy-ntlm and - communicate with a proxy that requires basic authentication, the proxy - properly returns a 407, but the failure detection code doesn't realize it - should give up, so curl returns with exit code 0. Test case 162 added to - verify the functionality. - -- allow newlines in the contents when doing -F "var=[contents]" - Robert Marlow reported. - -- If a transfer is found out to be only partial, libcurl will now treat that - as a problem serious enough to skip the final QUIT command before closing - the control connection. To avoid the risk that it will "hang" waiting for - the QUIT response. Added test case 161 to verify this. - -Daniel (21 April 2004) -- Modified the heuristics for dealing with the test 160 scenario. When a - connection is re-used and nothing at all is received from it (because the - server closes the connection), we will now retry the request on a fresh new - connection. The previous ECONNRESET stuff from January 30 was removed again - as it didn't detect the situation good enough. - -Daniel (20 April 2004) -- Added test case 160 to verify that curl works correctly when it gets a - connection reset when trying to re-use a connection. It should then simply - create a new connection and resend the request. - -Daniel (19 April 2004) -- No more 512 byte limit for host name (inclusing name + password) in libcurl. - An added bonus is that we use less memory for the typical (shorter URL) - case. - -- Cleaned up the sources to better use the terms 'hostname' and 'path' - internally when referring to that data. The buffers used for keep that info - is called 'namebuffer' and 'pathbuffer'. Much easier to read and understand - than the previous mess. - -Daniel (15 April 2004) -- Modified runtests.pl again to remove all log files in the log/ dir between - each test, and then made -p display all non-zero byte files in the log dir. - It should make that data more usable and contain less rubbish. - -- ftpserver.pl now produces log files more similar to how the sws ones look - and they now also contains a bit more details to help debugging ftp - problems. - -- Removed the fixed maximum amount of dir levels the FTP code supported. - Previously we had a fixed array for 100 levels, now we save space in each - handle by allocating only for a few level by default and then enlarging that - in case of need (with no maximum depth). Adjusted test case 142 to verify - that 150 dir levels work fine. An added bonus is that we use less memory - for the typical (not very deep) case. - -Daniel (14 April 2004) -- Asking for CURL_IPRESOLVE_V6 when IPv6 addresses can't be resolved will - now cause the resolve function to return NULL immediately. This flaw was - pointed out by Gisle Vanem. - -- Gisle Vanem made curl -4/-6 actually set the desired option to libcurl. - -- runtests.pl now has a new option (-p) that will display "interesting" log - files to stdout in case of a test failure. This is primarily intended to be - used in the 'full-test' make target that is used by the autobuild tests, as - we then get a much better chance to understand (remote) test failures based - on autobuild logs alone. - -Daniel (13 April 2004) -- Gisle Vanem made the multi interface work again on Windows even when built - without ares. Before this, select() would return -1 during the name resolve - phase since curl_multi_fdset() didn't return any fd_set at all which wasn't - appreciated! - -- curl_easy_duphandle() now duplicates the tcp_nodelay info as well. - -Daniel (11 April 2004) -- Applied David Byron's patch for the MSVC libcurl makefile for builds with - zlib. - -Daniel (9 April 2004) -- Dirk Manske improved the timer resolution for CURLINFO_*_TIME, it can now - be down to usec if the system sypports it. - -Daniel (7 April 2004) -- A request that sends "Expect: 100-continue" and gets nothing but a single - 100 response back will now return a CURLE_GOT_NOTHING. Test 158 verifies. - -- The strtoofft() macro is now named curlx_strtoofft() to use the curlx_* - approach fully. - -Daniel (6 April 2004) -- Gisle Vanem's fixed bug #927979 reported by Nathan O'Sullivan. The problem - made libcurl on Windows leak a small amount of memory in each name resolve - when not used as a DLL. - -- New authentication code added, particularly noticable when doing POST or PUT - with Digest or NTLM. libcurl will now use HEAD to negotiate the - authentication and when done perform the requested POST. Previously libcurl - sent POST immediately and expected the server to reply a final status code - with an error and then libcurl would not send the request-body but instead - send then next request in the sequence. - - The reason for this change is due to IIS6 barfing on libcurl when we attempt - to POST with NTLM authentication. The reason for the problems is found in - RFC2616 section 8.2.3 regarding how servers should deal with the 100 - continue request-header: - - If it responds with a final status code, it MAY close the transport - connection or it MAY continue to read and discard the rest of the - request. - - Previous versions of IIS clearly did close the connection in this case, - while this newer version decided it should "read and discard". That would've - forced us to send the whole POST (or PUT) data only to have it discarded and - then be forced to send it again. To avoid that huge penality, we switch to - using HEAD until we are authenticated and then send the POST. - - The only actual drawback I can think of (except for the odd sites that might - treat HEAD differently than they would treat POST/PUT when given the same - URL) is that if you do POST with CURLAUTH_ANY set and the site requires NO - authentication, libcurl will still use a HEAD in a first round and then do a - POST. - - If you do a HEAD or a GET on a site using CURLAUTH_ANY, libcurl will send - an un-authenticated request at once, which then is the only request if the - site requires no auth. - - Alan Pinstein helped me work out the protocol details by figuring out why - libcurl failed and what IIS6 expects. - -- The --limit-rate logic was corrected and now it works a lot better for - higher speeds, such as '10m' or similar. Reported in bug report #930249. - -- Introducing curlx_tvnow() and curlx_tvdiff() using the new curlx_* fashion. - #include "timeval.h" from the lib dir to get the protos etc. Note that - these are NOT part of the libcurl API. The curl app simply uses the same - source files as the library does and therefore the file needs to be compiled - and linked with curl too, not just when creating libcurl. - -- lib/strerror.c no longer uses sys_nerr on non-windows platforms since it - isn't portable enough - -Daniel (2 April 2004) -- In the curl_strnqual.3 man page, we now prepend the man3 dir to the file - name to work better. As pointed out by Robin Kay. - -- Andrés García updated the mingw makefiles. - -- Dirk Manske fixed a problem I recently added in the progress meter code that - broke subsecond resolution for CURLINFO_TOTAL_TIME. He also pointed out a - mistake in the code that produces the final update of the progress meter - that would often prevent it from actually being updated that final time. - -Daniel (1 April 2004) -- Dirk Manske fixed a memory leak that happened when we use ares for name - resolves and decides to time-out before ares does it. This fix uses the - brand new ares_cancel() function which is not present in c-ares 1.1.0. - - When told to enable ares, the configure script now checks for presence of - the ares_cancel function to alert users if they attempt to use a too old - c-ares library. - -Daniel (31 March 2004) -- Roy Shan fixed a flaw that prevented ares name resolve timeouts to occur! - -- Dirk Manske found out that libcurl timed out waiting for resolves far too - easy when libcurl was built to use (c-)ares for name resolving. - -- Further Digest fixing and a successful test case 153 now makes me believe - Mitz Wark's problems are fixed. - -- Andres Garcia figured out that test case 63, while working, only proved a - flaw in libcurl's 'http_proxy' parser when a user name and password is - provided. The user name was not extracted properly (and 'http' was always - used as user name). - -- Andrés García fixed compiler warnings in our ioctlsocket() usage. - -Daniel (30 March 2004) -- Joe Halpin faced problems with the getnameinfo() argument ai_flags and the - particular bit named 'NI_WITHSCOPEID' on Solaris 9 for Intel. I've now - written a configure test that checks for a working NI_WITHSCOPEID - implemenation. No code uses the result from this test yet, it is still - experimental. James Carlson wrote in comp.unix.solaris: "It's a bug - (5006623) -- it's not supported and shouldn't be in the header file." - -- I provided Mitz Wark with a first patch in order to fix libcurl's problems - to re-negotiate Digest authentication (when 'stale=true' is included in the - response header). - -- Roy Shan discovered that the multi interface didn't properly timeout name - lookups which could make handles get stuck in that state and thus never get - completed. I've produced a first test patch that attempts to correct this. - -- David Byron's patch was appplied to make CURLOPT_FAILONERROR work nicely - even with authentcations such as NTLM or Digest enabled. Test cases 150, 151 - and 152 were added to verify the functionality. - -Daniel (29 March 2004) -- Gisle Vanem updated files for the djgpp/MS-DOS build. - -- Andrés García helped me work out a fix for the runtests.pl script to make - the file:// tests run fine when tested with the mingw-built version of curl. - -- Fixed an include issue with netinet/tcp.h on AIX, based on input by Tor. - This also required a minor fix of the configure script. - -- The postit2.c source example used the wrong struct name for the post data. - -Daniel (26 March 2004) -- Gisle Vanem improved IPv6 support on Windows by making the curl build use - the correct getaddrinfo() function. - -Daniel (25 March 2004) -- It turned out that AIX, despite having a "thread-safe libc", doesn't offer - all traditional functions thread-safe. This URL is informative on this - subject: - - http://publibn.boulder.ibm.com/doc_link/en_US/a_doc_lib/aixprggd/ \ - genprogc/thread_quick_ref.htm - - As a result of this, we now check for three *_r() functions on recent AIX - versions as well that the URL mentions aren't thread-safe in AIX 5.1. - -- renamed curl_strerror.[ch] to strerror.[ch] - -- Joe Halpin added CURLOPT_TCP_NODELAY and --tcp-nodelay to make it possible - for users to disable the Nagle algorthim-usage. - -- Tor Arntsen provided some interesting strerror_r() knowledge. glibc has its - own API which differs from the POSIX one. Daniel adjusted the configure - script to detect the version in use, and the code now uses the new defines - accordingly. - -- Fixed some build flaws with the new lib/curl_strerror.c source file. - -Daniel (24 March 2004) -- Gisle Vanem's fix to replace the bad use of strerror(). This introduces - Curl_strerror() that attempts to be thread-safe _and_ works on Windows too! - -- Tor Arntsen spell-fixed lots of libcurl man pages. - -- Tor Arntsen made testcurl.pl work with older perl 5 versions, and Daniel - made it not use chdir .. to go back, as that isn't very good when you've - setup a testdir containing symlinks. - -- Added a check for strerror_r() in the configure script. - -Daniel (23 March 2004) -- Added Greg Hewgill's testcurl.pl script to CVS. We have not moved over to - use this script for the real distributed testing just yet, but it is only - a matter of time. - -- Gisle Vanem provided code that makes curl report a better error message - if --interface fails on windows. - -- The regular progress meter is now fixed to never wrap due to long lines. All - fields are now static sized. If the time in the time fields get a time value - that would represent a time that is 100 hours or more (if not, it remains - using a HH:MM:SS display), it switches first to a "NNNd NNh" display (for - days and hours) and if that isn't enough it switches to a "NNNd" display if - it is more than 999 days. - - Several of the calculations were also moved to fixed-point math instead of - using doubles. - -Daniel (22 March 2004) -- Glen Nakamura noticed CURLINFO_CONTENT_LENGTH_DOWNLOAD didn't work as it - used to do if CURLOPT_NOBODY is set TRUE. - -- Kevin Roth patched the cygwin package makefile and README to adjust to - new cygwin packaging guidelines. - -- Enabled "NT responses" in the NTLM authentication. Doing this simply means - that we provide an extra chunk of data in each "type-3 message". The only - reason for doing this is that it seems that using only the "Lanmanager hash" - (as we've been doing until now) doesn't support passwords longer than 14 - characters and it turns out there are users out there who want to use - libcurl and NTLM with such passwords! ;-) Seven NTLM-related test cases were - updated accordingly. Mentioned as issue 29 in TODO-RELEASE, bug report - #915609 - -- Moved the generated libcurl version info to a new header file, named - curl/curlver.h. Now interested parties can include ONLY version info, should - anyone want that (and it seems at least some windows resource files would). - Mentioned as issue 27 in TODO-RELEASE. - -Daniel (21 March 2004) -- Fixed the root Makefile to use tabs for the netware target. Günter Knauf - pointed this out. - -- Marty Kuhrt's VMS cleanup - -- Thomas Schwinge made buildconf recognize ACLOCAL_FLAGS to invoke aclocal - with particular pre-determined options. - -Version 7.11.1 (19 March 2004) - -Daniel (18 March 2004) -- Tor Arntsen brought some info about SGI IRIX: - - IRIX supports 3 different executable/object formats, -32, -n32 and -64. - -n32 is default 32-bit format, -32 is the "old" 32-bit format, and -64 is - the 64-bit format. Libraries for the different formats are in lib, lib32 - and lib64 respectively. - - We've now adjusted the configure script to adapt to this when scanning for - 3rd party libs, such as OpenSSL. - -Daniel (17 March 2004) -- Watz pointed out a few missing files in the MSVC project description file. - -- Günter Knauf brought patches, code and makefiles to build curl on Novell - NetWare. - -Daniel (15 March 2004) -- Lots of libcurl man pages were updated to contain references to other man - pages the recognized way so that they appear as nice hyperlinks in the HTML - versions. - -- buildconf now checks the m4 version too, since autoconf requires a GNU m4 - version to build proper configure scripts. - -Daniel (12 March 2004) -- Added CURLOPT_POSTFIELDSIZE_LARGE, the large file version of - CURLOPT_POSTFIELDSIZE to allow POSTs larger than 2GB. - -- David Byron fixed an uninitialized variable case/crash. - -Daniel (10 March 2004) -- Jeff Lawson fixed the SSL connection to deal with received signals during the - connect. - -- Changed the OS string for win32 to become "i386-pc-win32". - -Daniel (9 March 2004) -- Changed the internals to use curl_socket_t for socket variable type. This - should enable us to build with less warnings on Windows, where SOCKET is - used which is an unsigned int, while most other platforms use a mere int. - -- Modified lib/config-win32.h to build fine on MSVC again. - -Version 7.11.1-pre1 (8 March 2004) - -Daniel (8 March 2004) -- Minor fix to make curl CURL_VERSION_LARGEFILE is only set if curl_off_t is - larger than 4 bytes. - -Daniel (4 March 2004) -- Improved PUT/POST with NTLM/Digest authentication, the so called issue 12. - -- Modified the test HTTP server a lot to work with the upcoming changes for - PUT/POST with NTLM/Digest authentication (like test case 88). Added Andrés - García's win32-changes. Improved the logging. - -- Fixed the file:-related progress/getinfo stuff a bit more. - -Daniel (4 March 2004) -- I corrected a problem with the multi interface when following a Location: - header or when doing multiple-request authentications. A subsequent request - could erroneously re-use a previous connection that was sent with - Connection: close. Christopher R. Palmer reported. - -- Andrés García patched curl to prevent warnings while compiling with mingw, - mainly because it is now possible to have both WIN32 and HAVE_CONFIG_H - defined. - -- When transferring files from a file: URL, the progress meter and other - transfer metrics were not updated properly. - -- David Byron provided a "version resource" file to the curl executable for - the windows builds. - -Daniel (3 March 2004) -- David Byron's work on making libcurl only require winsock 1.1 on Windows - machines. - -- More variable cleanups based on compiler warnings generated by Tor Arntsen's - autobuilds with MIPSPro. - -- Joe Halpin helped us fix some pedantic compiler warnings on FreeBSD. - -- Applied Tom Bates' patch to build on nsr-tandem-nsk. - -- Dan Fandrich corrected some flaws in the configure GSS detection. - -Daniel (2 March 2004) -- Fixed the libcurl code to use FORMAT_OFF_T for printf() formatting - curl_off_t types internally. - -Daniel (1 March 2004) -- Added CURL_VERSION_LARGEFILE as a feature-bit in the curl_version_info() - response, that signals if this libcurl supports >2GB files. curl -V now - outputs 'Largefile' in the Features: field if this is the case. Most systems - are likely to support this. - -- We offer a CURL_FORMAT_OFF_T define in the public header, which can be used - to printf() curl_off_t variables. We also modified the libcurl sources to - use this define instead of the previous %Od approach (although I've left the - O-flag functional in the code). This should also prevent compilers to warn - on the home-grown option. - -- Fixed the resume-check code to test for a working resume at the end of the - headers and not at the first body-byte. - -- CURLOPT_DNS_USE_GLOBAL_CACHE is now considered obsolete. Stop using it. If - you need a global DNS cache for whatever reason, use the share interface and - you'll get a global cache that works the way it should work. You can even - have any number of global caches, all at your command. This is now also - mentioned in the docs. - -- Made the *printf code support the z-flag to enable size_t printf() in a - manner similar to how glibc allows it. To make printfing of this work on - platforms with 64bit size_t and 32bit ints. If there even are any! ;-) - -- Christopher R. Palmer discovered that if you CURLOPT_FRESH_CONNECT and - CURLAUTH_NTLM (or CURLAUTH_ANY and libcurl then picked NTLM), libcurl would - loop without succeeding to authenticate due to the new connection that was - made for all round-trips in the authentication. Now, the FRESH_CONNECT is - remade to only matter for the first connection made with curl_easy_perform() - and all the rest that might follow due to FOLLOWLOCATION or HTTP - authentication are now ignoring that option. - -- Adjusted the QUIT code slightly since it could core-dump. - -- Corrected the test suite's FTP server to provide a correct size to the - 'verifiedserver' request. - -Daniel (27 February 2004) -- Joe Halpin made the FTP code send QUIT on the control connection before - disconnecting the TCP connection. This is what good-behaving ftp clients - should do. - -Daniel (26 February 2004) -- David Byron updated several files to make curl build fine on MSVC 6. He - also added the 'buildconf.bat' that works like the 'buildconf + configure' - combo does on unixes. - -- Gisle Vanem made the memdebug stuff support calloc() as well. - -- Tor Arntsen pointed out that testcurl.sh needed to remove the generated - files in order to have them re-generated in each build. - -- Andy Serpa found out that the share interface did not enjoy life when not - having the lock and unlock callbacks set, even though documented to be - OK. It still is OK, and now the code won't segfault anymore! - -Daniel (25 February 2004) -- Based on a patch by Greg Hewgill I modified how long long is used in the - mprintf code, as we can use a 64bit type with MSVC that is a long long - equivalent. This corrects some weird large file behaviors on windows. - -- Tor Arntsen helped me work out --enable-debug to work better with different - versions of the gcc and icc compilers. - -- Added CURLOPT_SHARE to the curl_easy_setopt.3 man page. - -Daniel (22 February 2004) -- Applied the final pieces of Gisle Vanem's patch that brings a working name - resolve timeout to the windows versions of curl! - -Daniel (21 February 2004) -- David Byron's fix to allow the speed-limit logic work even if you set - limit-rate. It does work on the expense of the rate limiter. - -Daniel (20 February 2004) -- configure --enable-debug with gcc now also tries to detect the icc compiler - (which somehow gets treated as if it is a gcc) to stop using all the gcc - options with it, and we also provide -isystem options for each extra -I - option the configure script has figured out (for OpenSSL, kerberos, zlib, - Heimdal etc). This of course to prevent warnings on headers we don't have - control of. - -Daniel (19 February 2004) -- Doug Porter made libcurl use the HOME environment variable before the - getpwuid results when looking for .netrc files. - -- If 'configure --enable-debug' is used with gcc, it now checks which gcc - version it is and uses as picky compiler options as possible for the - particular version. - -- Code that can be used in both the lib and in the curl app is now made to use - the curlx_ prefix. The first function to be available like this is the - curlx_strtoll() function. This is made to allow the app to use existing code, - but without polluting the libcurl API. Further explanations posted here: - - https://curl.haxx.se/mail/lib-2004-02/0215.html - -Daniel (18 February 2004) -- Fixed buildconf to not use "which" as AIX and Tru64 have what have been - referred to as "horribly broken 'which' programs". - -- Made sure dns cache timeout set to -1 really means caching forever. - -Daniel (17 February 2004) -- Made it possibly to build c-ares with the libcurl memdebug system to better - track memory. - -Daniel (16 February 2004) -- When using ares, we now initialize the ares 'channel' in curl_easy_init() - and re-use that same handle during the entire curl handle's life-time. It - improves performance. - -- Fixed a problem when displaying verbose for IPv6-enabled libcurls and - re-used connections. Problem reported and fix verified by Grigory Entin. - -- Jeff Lawson fixed the version-check in the SOCKS5 code. - -Daniel (15 February 2004) -- Fixed a case where a host cache entry was not flagged in-use properly when a - cached entry was used. - -- Andrés García's patch that checks for winmm in the configure script was - applied. - -Daniel (13 February 2004) -- Ben Greear's SO_BINDTODEVICE patch for the binding of the local end to a - specific network interface. - -- Greg Hewgill found out that the variable holding 'contentlength' wasn't big - enough to hold a large file! - -- Tor Arntsen fixed a 64bit-related problem in date-related code in the ftp - department, and there was another potential problem in the name resolve code - too. - -Daniel (11 February 2004) -- Removed a few variables that were only set but never used, as some compilers - warn about that and we do not like compiler warnings! - -- Removed the need for symlinks in the tests/data directory if curl is built - outside of the source directory and the 'make test' is used. This was done - by providing a "source dir path" to the scripts/servers. - -- Now, if the configure script can't find an nroff tool or an option to nroff - to use to convert man pages with, it will completely switch off the built-in - manual. - -- 'configure --disable-manual' completely disables the built-in manual from - the curl command tool. - -- Andrés García fixed the configure script and a minor source edit, and now - he has managed to get msys/mingw to run configure and then build! - -Daniel (9 February 2004) -- The default HTTP Accept: header was modified to the much simpler - "Accept: */*". - -- P R Schaffner updated the curl-ssl spec file for RPMs. - -- Dominick Meglio brought lots of documentation for the share interface's man - pages that were previously missing. - -- Tor Arntsen provided a patch that makes libcurl work-around a bug in the - AIX5 implementation of getaddrinfo(). This makes the FTP PORT stuff work on - IPv6-enabled AIX builds. - -- Ken Rastatter provided portability fixes for the curlgtk.c example, and now - it runs on windows with GTK as well! - -Daniel (6 February 2004) -- Andrés García made the configure script find gethostbyname() fine when run - with mingw on windows. - -- Modified the ldap code to use proper function pointers all over (instead of - mixed data and function pointers) to work-around the picky MIPSPro compiler - warnings. - -- A custom Host: header is only considered if the request is not made by - following a location. After discussions with Tim Baker. - -Daniel (5 February 2004) -- The libz part of the configure script now only set the two libz-related - define HAVE_ZLIB_H and HAVE_LIBZ if both the lib and the header is found. - If one is missing, none of the defines is set. - -- Andrés García fixed the Mingw makefiles. - -- Len Krause reported that curl 7.9.X could do uploading from stdin without - doing chunked encoding, which current curl cannot do even if you disable - the transfer-encoding chunked header. Now it can again, and test case 98 - verifies this functionality. - -- Tor Arntsen fixed a weird getaddrinfo() usage in the FTP code, preventing - the IPv6-code for PORT work on AIX 5.2. We now also provide (better) error - messages when bailing out in the that function. - -- Tor Arntsen now provides AIX and IRIX (using gcc, xlc and the MIPSPro - compilers) automated build logs (https://curl.haxx.se/auto/) and we've fixed - numerous minor quirks to make less warnings appear. - -Daniel (4 February 2004) -- Based on a patch by Gilad, we now use the custom timeouts when waiting for a - server to connect when using FTP PORT. Previously we always waited 10 - seconds, no more no less. We now also changed the default (if no timeout is - set) to wait 60 seconds for the connect before we fail. - -Daniel (3 February 2004) -- Modified to link with c-ares instead of ares. - -Daniel (2 February 2004) -- Added a configure test to check for which option the (g)nroff tool wants - to extract plain text from the man pages. Tor Arntsen told us the AIX - version of GNU gnroff doesn't support -man! - -- Added an undef of accept in memdebug.h to make curl build with --enable-debug - on AIX 5.2 which seems to have accept defined. Reported by Tor Arntsen. - -- curl_version() now includes c-ares version info, and curl_version_info() now - returns a struct with version SECOND that also includes that info. - -- We are now officially using c-ares for asynch name resolves. c-ares is the - new library, based on the existing ares but with an extended and slightly - modified API. - -- Dirk improved the ares timeout code, and now we also include the ares error - string when we fail to resolve a name. - -- Another tweak to make test case 91 run fine. Now we have another bit on a - connection that is set true if the connection is marked for 'retry'. That - makes the connection get closed and re-opened and the HTTP-done code must - not complain on the fact that no data was received. - -- Based on Dirk Manske's patch, I modified the name resolving with ares to - feature a timeout for really slow lookups. It now defaults to 300 seconds, - but is now adjusted to the CONNECTTIMEOUT/TIMOUE timeouts if one of them - is set. - -- Fixed the inclusion of ca-bundle.h to really use the one in the build dir - before the one in the source dir. Domenico Andreoli found out and reported. - -- Added test case 97, a simple POST with a custom Content-Type header - replacing the original application/x-www-form-urlencoded one. - -Daniel (30 January 2004) -- Added code that attempts to fix the test 91 failure. As has been figured out - by Patrick Smith, the error happens because we re-use a connection that the - server is just about to close and we even manage to send away the request - without seeing an error. On the first read attempt we get a ECONNRESET. - Starting now, we attempt to detect this and if so, we retry the request on a - fresh connection. - -- I added test case 510 which is a custom program that does a POST using a - read callback, with chunked transfer-encoding. - -- Adjusted one of the MPE/iX changes as it made test case 504 fail all over. - -- Added --socks as a recognized option. It works just like --proxy but sets a - SOCKS5 proxy to use. SOCKS5 support has been available in libcurl for a - while, just not provided by the curl tool. This does not currently work for - IPv6-enabled libcurls. - -Daniel (29 January 2004) -- Stadler Stephan pointed out that src/hugehelp.c included config.h without - checking the define if its present... - -- Ken Hirsch provided patches to make curl build fine on the MPE/iX operating - system. - -- Dan Fandrich compiled curl with lots of aggressively pedantic compiler - options and thus found a few minor errors and did some general cleanups to - avoid them. - -- Dirk Manske fixed a flaw in ares that prevented it to use non-blocking - sockets properly. - -Daniel (28 January 2004) -- Richard Bramante fixed chunked transfer-encoded "uploads" to send a final - CRLF combo properly. - -Daniel (27 January 2004) -- Made the response-headers during a CONNECT request to a proxy get passed on - as regular headers, so they appear with -i/-I options and similar. - -- Based on a patch by Gisle Vanem, I've made the progress meter display - properly switch to a GB-display when more than 9999MB have been transfered. - -Daniel (23 January 2004) -- Gisle Vanem pointed out a curlrc parser problem/crash when an option with a - required didn't have one and was on the last line of a file. - -- More Windows fixes for large files. We now build and link with - ../lib/strtoofft.c in the app code since Curl_strtoll() is not a provided - libcurl function... Perhaps we should consider a 'common' dir or similar - where we put source code used in both the lib and the client. Or perhaps - we'll just make this function available in the library... - -- Vincent Bronner found out the socks5 code crashed when no username was - set. - -- Vincent Bronner spotted a problem with proxy username/password when re-using - a persistent connection. - -- Fixed the progress meter display for files larger than 2^31 bytes. Gisle - Vanem reported. - -Daniel (22 January 2004) -- Gisle Vanem made strtoll() get used when curl is built with the mingw - compiler. - -- Gisle Vanem fixed the compressed help text code to display properly. - -- Removed the '#define HttpPost' from the public header file, as curl_httppost - is the proper name and it has been for quite some time now. Fixes another - name space pollution. - -- Added 'curl_off_t' typedef in the public header file, to be used to provide - large file sizes to the *_LARGE options. Adjusted the code all over to use - this variable type instead of 'off_t'. This is an attempt to make the large - file support work on more platforms. The configure script now checks the - size of the curl_off_t instead of the plain off_t. - -Version 7.11.0 (22 January 2004) - -Daniel (21 January 2004) -- Removed the defines in the public header file with TIMECOND_ prefixes. They - have been obsolete since April 22nd 2002, and if this causes anyone any - problems now it is very easy to just add CURL_ to the names. This corrects - this name space pollution. - -Daniel (19 January 2004) -- David Byron cleaned up how --trace with no option was treated, and also - arguments in a config file without a required parameter! - -Daniel (16 January 2004) -- Gisle Vanem fixed a few issues where compilers warned about variables - possibly being used unassigned. - -- Minor Interix build problem fixed. - -Daniel (15 January 2004) -- Peter Sylvester pointed out some necessary escaping needed in the - acinclude.m4 file when automake 1.8 or later is used. - -Daniel (14 January 2004) -- Vincent Bronner fixed the Curl_resolv() return code. This extends the fix - Steve Green provided on december 3... - -Daniel (13 January 2004) -- Luke Call made the win32 version of the password prompting function support - backspace. - -- Dan Fandrich fixed the hugehelp source file to contain both a compressed and - an uncompressed version in the distribution, so that more people easier can - build curl with the compressed version. - -- Diego Casorran brought another AmigaOS build patch for native Amiga builds. - -- Matt Veenstra updated the Mac OS X framework files. - -- Brian R Duffy brought a section to the INSTALL file on how to build a - SSL-enabled curl using the free Borland C++ compiler. He also updated the - Borland lib/Makefile.b32. - -- I fixed the test case 509 which I broke yesterday. Now the libtest are - compiled with an include path that points to the library's source dir, so - that the libtests can include files from the source tree. This was made to - make it possible to use the USE_SSLEAY define in the library test files. - -Daniel (12 January 2004) -- Peter Sylvester brought code that now allows a callback to modified the URL - even when the multi interface is used, and then libcurl will simulate a - "follow location" to that new URL. Test 509 was added to test this feature. - -- Extended the time we retry servers in the test script, and I also made it - retry the https and ftps servers before they are considered bad. I believe - the previous approach could turn problematic on really slow hosts. - -Version 7.11.0-pre1 (12 January 2004) - -Daniel (11 January 2004) -- Dominick Meglio pointed out FTPS should use default port 990 according to - IANA. - -Daniel (8 January 2004) -- Fixed the SPNEGO configure check to not use -R or other non-portable options - in the LDFLAGS. Reported by Pierre in bug report #872930. - -Daniel (5 January 2004) -- Dan Fandrich provided a fix on our zlib usage. - -- David J Meyer's patch that introduce large file support to libcurl was - applied. New curl_easy_setopt options that accept 'off_t' arguments are: - - INFILESIZE_LARGE - RESUME_FROM_LARGE - MAXFILESIZE_LARGE - -Daniel (4 January 2004) -- Based on Dominick Meglio's comments, I made our private version of - gettimeofday() declared static. This would otherwise collide with the same - function in other libs (like ares for example). - -- Added Dominick Meglio's description on how to build libcurl with ares - on win32. -Daniel (19 December) -- CURLOPT_IPRESOLVE was not possible to set. - -- Gisle Vanem updated the djgpp build files. - -Daniel (18 December) -- John McGowan reported a redirect-problem that happened if a site used a URL - like "url.com?var=content" (without a proper slash) and from that address - redirected the user-agent to an absolute directory. - -- David Byron made libcurl build fine with both the .NET and VC6 versions of - MSVC - -Daniel (16 December) -- Updated test 506 since it started to fail after the cache prune change - yesterday. I also changed it slightly to feature a counter in each debug - output for easier tracing. - -Daniel (15 December) -- Old DNS cache entries are now only pruned after curl is done with a request, - and not in the actual name resolve call. - -- corrected the --enable-ares patch - -- Giuseppe Attardi found and fixed a problem within libcurl that re-used - already freed memory. - -Daniel (10 December) -- Gisle Vanem reported that the dict support was broken. I broke it during my - ftps-changes overhaul. I've now added a 'curlassert' function that can be - used to verify expressions, to prevent future errors of the same - kind. They're only present in debug-builds. - -- Diego Casorran made curl and libcurl possible to build natively (no more - need for the ixemul library) on AmigaOS. - -- Dominick Meglio made configure --enable-ares support a given path to the - installed ares lib, instead of always using it in the curl source tree. - This also fixed the curl-config --libs output. - -- Eric S. Raymond patched a very minor man page format error in - libcurl-errors.3 - -Daniel (8 December) -- Fixed the flaw that made -lz appear twice on the link command line. - -- After correspondence with Gisle Vanem, I changed the 'connection aborted' - error text when the FTP response reader failed to more specificly identify - what the problem is. - -- Based on a patch from Dominick Meglio, curl-config --feature now outputs - 'AsynchDNS' as a feature if libcurl was built with ares. The feature name - is the same that 'curl -V' outputs, for simplicity. - -Daniel (3 December) -- Marty Kuhrt made the build up-to-date on VMS, and moved most of the VMS- - specific stuff in the client code to a separate header file. - -- Steve Green fixed a return code bug in Curl_resolv(), that made the socks5 - code fail. - -- swalkaus at yahoo.com patched libcurl to ignore Content-Length: headers - when Transfer-Encoding: chunked is used, as mandated by RFC2616. - -Daniel (2 December) -- --ftp-pasv was added, which serves the only purpose of overriding a - previously set --ftpport option. Starting now, --ftp-port is a recognized - alias for --ftpport for consistency. - -- Giuseppe Attardi pointed out that we should use MSG_NOSIGNAL when we use - send() and recv(). I added checks for the define in the configure script and - adjusted the code accordingly. If the symbol is present, we won't attempt - to ignore the SIGPIPE signal. - -Daniel (1 December) -- Mathias Axelsson set up a bsdftpd-ssl server for me and I could make curl - run fine against its FTPS implementation. Now these FTPS-related things - work: - o explicit and implicit FTPS - o active (PORT) and passive (PASV) - o upload and download - o verified against bsdftpd-ssl and RaidenFTPD - -Daniel (27 November) -- James Clancy made the Borland Makefiles up to date. - -- Markus Moeller improved the SPNEGO detection in the configure script. - -Daniel (25 November) -- Dave May filed bug report #848371, identifying that if you'd do POST over a - proxy to a https server, libcurl didn't POST at all, it just made a GET! It - turned out to be because libcurl wrongly didn't consider the authentication - "negotiation phase" to be complete yet. - - I added test case 95 to verify my fix for this. - -Daniel (24 November) -- Thanks to Mathias Axelsson, I've been able to work on FTPS for libcurl and it - seems to work somewhat fine now. - - The FTPS stuff is based on RFC2228 and the murray-auth-ftp-ssl draft - (version 12). There seems to exist quite a few servers that have implemented - the server side of this. - - We can now use ftps:// URLs to explicitly switch on SSL/TSL for the control - connection and the data connection (dealing with two SSL connections forced - me to change a lot of stuff in libcurl). - - Alternatively, and what seems to be the recommended way, we can set the new - option CURLOPT_FTP_SSL to one of these values: - - CURLFTPSSL_NOPE, - do not attempt to use SSL - CURLFTPSSL_TRY - try using SSL, proceed anyway otherwise - CURLFTPSSL_CONTROL - SSL for the control connection or fail - CURLFTPSSL_ALL - SSL for all communication or fail - - Any failure to set the desired level will make libcurl fail with the error - code CURLE_FTP_SSL_FAILED. This new option makes a "normal" ftp:// transfer - attempt to be made securely. - - I've been able to login and get files (passively) from Mathias' server using - both ftps:// and CURLOPT_FTP_SSL. (I've made 'curl' understand the --ftp-ssl - option that sets CURLFTPSSL_TRY.) - -- Gaz Iqbal fixed a range string memory leak. - -- Gisle Vanem fixed the Windows builds. - -- Added the new FTPSSL defines in curl/curl.h - -Daniel (20 November) -- Josh Kapell filed bug report #845247 as he found an endless loop when - getting a 407 back from a proxy when no user+password was given. Added test - case 94 to verify the fix. - -Daniel (19 November) -- Kevin Roth fixed a progress-bar problem on Windows. - -- While working with Nicolas Croiset's bug report #843739, I noticed two minor - problems related to ftp partial downloads: if a partial transfer is - detected, we must close the connection as we cannot know in what state it is - anymore. This looks like a ProFTPD bug: - https://curl.haxx.se/mail/lib-2003-11/0079.html - -Daniel (17 November) -- Maciej W. Rozycki made the configure script use a cache variable for the - writable argv test. This way, the default can be overridden better (for - cross-compiles etc) - -Daniel (15 November) -- Mathias Axelsson found out libcurl sometimes freed the server certificate - twice, leading to crashes! - -Daniel (14 November) -- Siddhartha Prakash Jain found a case with a bad resolve that we didn't - properly bail out from, when using ares. - -Daniel (13 November) -- Default Content-Type for parts in multipart formposts has changed to - "application/octet-stream". This seems more appropriate, and I believe - mozilla and the likes do this. In the same area: .html files now get - text/html as Content-Type. (Pointed out in bug report #839806) - -- Gisle Vanem corrected the --progress-bar output by doing a flush of the - output, which apparently makes it look better on at least windows, but - possibly other platforms too. - -- Peter Sylvester identified a problem in the connect code, which made the - multi interface on a IPv6-enabled Solaris box do bad. Test case 504 to be - specific. I've spent some time to clean-up the Curl_connecthost() function - now to use less duplicated code for the two different sections: IPv6 and - IPv4. - -Daniel (11 November) -- Added CURLOPT_NETRC_FILE. Use this to tell libcurl which file to use instead - of trying to find a .netrc in the current user's home directory. The - existing .netrc file finder is somewhat naive and is far from perfect on - several platforms that aren't unix-style. If this option isn't set when - CURLOPT_NETRC is set, the previous approach will still be used. - - The current .netrc check code now also support longer than 256 bytes path - names. - -Daniel (10 November) -- Kang-Jin Lee pointed out that the generated ca-bundle.h file shouldn't be - written in the source dir if a different build dir is used. - -- After Sébastien Willemijns' bug report, we now check the separators properly - in the 229-reply servers respond on a EPSV command and bail out better if - the reply string is not RFC2428-compliant. - -Daniel (7 November) -- Based on Gisle Vanem's patch, I made curl try harder to get the home - directory of the current user, in order to find the default .curlrc file. - We're also considering moving out the HOME-dir code from libcurl, and - instead have the app pass in the path to the .netrc file (which is the only - logic left in libcurl that uses the HOME dir). Then curl can use the home - dir for that purpose too. - -- Ralph Mitchell's updated testcurl.sh to the script to take an existing - directory name and build/run/test curl in there instead of trying to update - from CVS. Using this approach, the script can now be used to test daily - tarballs etc. - -- Gisle Vanem added a "resource file" to the Windows DLL builds, to contain - information such as version number, library name, copyright info etc. - -Daniel (6 November) -- curl checks if the existing libcurl supports things like --ntlm, --negotiate - and --krb4 and returns error if not. - -- I added three new global defines in the curl/curl.h header: - LIBCURL_VERSION_MAJOR, LIBCURL_VERSION_MINOR and LIBCURL_VERSION_PATCH. They - are the three numbers in the library's version number, separated for easier - usage. 'maketgz' was updated accordingly to generate these numbers properly - when building release-archives. - -- Uninitialized variable fix, reported by both Marty Kuhrt and Benjamin - Gerard. - -- Matt Veenstra provided build files to build libcurl as a "framework" under - Mac OS X. See the lib/libcurl.framework.make for details. - -- Removed the defines of TRUE and FALSE from the curl/curl.h header file. - They're not in our name space so we should not fiddle with them. - -Daniel (5 November) -- Replaced the man page to HTML converter program with a new one: roffit. - Makes nicer web pages. - -Daniel (4 November) -- Troels Walsted Hansen fixed the MSVC makefiles to let them build curl fine - on Windows. - -- Kevin Roth corrected the cygwin package generator and spell-fixed the - comment in the ca-bundle.h file. - -Version 7.10.8 (1 November 2003) - -Daniel (31 October) -- Assume that MDTM on an FTP server returns the timestamp using the UTC time - zone. This changes the time CURLINFO_FILETIME returns for a given file over - FTP, and will change existing uses of CURLOPT_TIMECONDITION. It will make - the functionality more similar to how the HTTP one is already working. - -- Command line options that take numerical parameters (such as -y, -Y, -C etc) - now report error and exit if the parameter isn't truly a number greater than - or equal to zero. This helps users to notice bad usage earlier. Before, when - a user forgot or missed to add a numerical parameter to an option, the - command line parser would simply "eat" the following option and it would - cause great confusion. - -Daniel (30 October) -- David Hull made libcurl deal with NOBODY and HEADER for file:// the same way - it already does for FTP: it provides HTTP-looking headers that provide info - only about the file, without doing the actual transfer. The curl tool then - lets --head do this. - -Daniel (29 October) -- runtests.pl now checks for and use valgrind if present. It will redirect the - valgrind results in log/valgrind[num] but it currently doesn't scan that - file for any errors or anything, that is still only made manually. - -- David Hull made the file: URL parser also accept the somewhat sloppy file - syntax: file:/path. I added test case 203 to verify this. - -Daniel (28 October) -- Dan C tracked down yet another weird behavior in the glibc gethostbyname_r() - function for some specific versions (reported on 2.2.5 and 2.1.1), and - provided a fix. On Linux machines with these glibc versions, non-IPv6 - builds of libcurl would often fail to resolve perfectly resolvable host - names. - -Daniel (26 October) -- James Bursa found out that curl_msnprintf() could write the trailing - zero-byte outside its given buffer size. This could happen if you generated - a very long error message as then libcurl would overwrite the ERRORBUFFER - with one byte. Using a non-existing very long local file:// name is one case - that could make this occur. - -Daniel (24 October) -- David Hull filed bug report #829827. It identified a problem with -C - if - the full file already was downloaded and thus the server responded with a - 416. libcurl would then wrongly use the Content-Length: header and expect - that size to get transfer, causing a "hang" until the server closed the - connection and then an error 18 ("still N bytes data left of the transfer"). - - Now we don't return any error at all, but I think libcurl should perhaps - return some kind of info since the requested range was out of the size of - the document. - -- Based on David Hull's fix in bug report #804599, we now check for solaris and - gcc in configure and set the -mimpure-text link flag for linking the lib - better. - -- I've introduced a -t option to the runtests.pl script. With that option set, - the script runs special "memory torture" tests. For each test command line - in that section, the script first runs the command line and counts the total - amount of allocations made. It then runs the exact same command line again, - forcing allocation number N to fail. It will try every N from 1 to the total - number of amounts made. For every invoke, it checks that no memory was - leaked as that would indicate a bad cleanup somewhere in the code. - - This is just beginning to work, and I've already made some corrections in - libcurl code. When this code works somewhat fine, I'll make sure 'make test' - in the root dir will run these tests as well. - -Daniel (23 October) -- Georg Horn fixed how the CA verification is made. Verifications can now be - made while at the same time the result of it can be ignored. This also - affects the curl tool as -k can now be used together with --cacert or - --capath. - -Daniel (22 October) -- Gisle Vanem found out --disable-eprt didn't work and patched it. - -- Test case 91 was modified and could now repeat the problem Kevin Roth has - reported, and the bug was fixed. - -- Dylan Ellicott added vc-libcurl-ssl-dll as a target to the root makefile - to build a static libcurl that links with a shared OpenSSL using MSVC. - -Daniel (21 October) -- Andrés García updated the mingw32 makefiles. - -Version 7.10.8-pre5 (21 October 2003) - -Daniel (19 October) -- Georg Horn made libcurl output more info on SSL failures when receiving - data. - -Version 7.10.8-pre4 (18 October 2003) - -Daniel (17 October) -- Dominick Meglio implemented CURLOPT_MAXFILESIZE and --max-filesize. - -- Made libcurl show verbose info about what auth type and user name that is - being sent in its HTTP request-headers. - -Daniel (16 October) -- Removed support for CURLOPT_PASSWDFUNCTION and CURLOPT_PASSWDDATA. libcurl - no longer prompt for passwords under any circumstances. Password prompting - was instead moved to curl, which now prompts for password if -u or -U lack - it. This solves the problem Kevin Roth reported when curl prompted for - password twice when doing NTLM authentication. - -- I rewrote the SSL subjectAltName check to avoid having to rely on OpenLDAP- - licensed derivate code. - -Daniel (15 October) -- Avoid doing getsockopt() on Windows to verify connects. It seems that this - hogs Windows machines when libcurl is being used multi-threaded (with > ~50 - threads). Andrew Fuller helped us verify and test this. - -Daniel (14 October) -- Kimmo Kinnunen fixed a crash with duphandle() when CURLDEBUG is set. - -- Gisle Vanem made libcurl build and work with IPv6 on Windows. - -Daniel (13 October) -- Giuseppe Attardi reported yet another segfault with ares and the multi - interface. Me fixed. - -- Domenico Andreoli removed the extra LDFLAGS assignment in lib/Makefile.am - that was reported about in the debian bug report #212086. - - Domenico also fixed two makefiles where we used 'gnroff' instead of the more - portable $(NROFF). - -Daniel (12 October) -- Dirk Manske made the share locking around DNS lookups slightly different to - allow the share system's DNS lookups to run somewhat more - independent/faster. - -Daniel (9 October) -- Lachlan O'Dea fixed a resume problem: "If I set CURLOPT_RESUME_FROM, perform - an HTTP download, then reset CURLOPT_RESUME_FROM to 0, the next download - still has a Range header with a garbage value." bug report #820502 - -- Dominick Meglio made the inet_pton.c file build fine using MSVC. - -- The 'sws' test suite web server now #include setup.h from the lib directory. - This makes it more portable easier. - -Version 7.10.8-pre3 (8 October 2003) - -Daniel (8 October) -- Frank Ticheler provided a patch that fixes how libcurl connects to multiple - addresses, if one of them fails (IPv4 code). - -Daniel (7 October) -- Neil Dunbar provided a patch that now makes libcurl check SSL - subjectAltNames when matching certs. This is apparently detailed in RFC2818 - as the right thing to do. I had to add configure checks for inet_pton() and - our own (strictly speaking, code from BIND written by Paul Vixie) provided - code for the function for platforms that miss it. - -- HTTP POST using the read callback didn't work, as Florian Schoppmann - reported. - -Daniel (5 October) -- Shared provided a few fixes to make libcurl build on BeOS - out-of-the-box. New code for BeOS-style non-blocking sockets, provided by - Shard and Jeremy Friesner. Modified the autoconf check for non-blocking - sockets to check for this kind too. - -Daniel (4 October) -- Vincent Bronner pointed out that if you set CURLOPT_COOKIE for a transfer - and then set it to NULL in a subsequent one, the previous cookie was still - sent off! - -- Jon Turner fixed a problem libcurl had when it failed on an FTP transfer due - to a bad path, it would cause the next transfer to use a bad path as well. - -- Siddhartha Prakash Jain provided a patch with a fix for libcurl with ares, - when working on IP-only names as we then could return "wait" status when the - name in fact already was resolved. I edited the patch slightly to not expose - asynch details to non-ares aware source code. - -Daniel (3 October) -- Neil Spring posted the debian bug report #213180, and pointed out that using - the name 'access' in a function prototype is not very wise as some compilers - complain. - -- Peter Sylvester provided his and Jean-Paul Merlin's curlx.c example source - code that shows how they use ssl and callbacks. - -Daniel (2 October) -- James MacMillan's patch makes curl build on QNX 6.2.x. - -Daniel (26 September) -- My daughter was born! - -Daniel (23 September) -- Added support for -4/--ipv4 and -6/--ipv6 to force names to resolve to that - particular IP version. They only work for IPv6-enabled libcurls. - -- curl -V now outputs 'SPNEGO' as a feature in case libcurl was built to - support that. - -Version 7.10.8-pre2 (22 September 2003) - -Daniel (22 September) -- Giuseppe Attardi found a segfault in libcurl when using the multi interface - with ares and doing repeated operations against a non-resolving host name. - -Daniel (19 September) -- Added the CURLOPT_IPRESOLVE option, that allows an application to select - what kind of IP addresses he wants to use when resolving host names. This - is only interesting when using host names that resolve addresses using more - than one version of IP. - -- Applied Markus Moeller's patch that introduces SPNEGO support if libcurl - is built with the FBopenssl libraries. curl_version_info() now returns - info on SPNEGO availability. The patch also made the GSSAPI stuff work fine - with the MIT GSS-library (the Heimdal one still works too). - -Daniel (16 September) -- Doing PUT with --digest failed, as reported in bug report #805853. - -- Using --anyauth that picked NTLM, and then a redirect closed the connection - and took curl to a second NTLM page made curl fail. Bug report #806328 - identified the problem, test case 90 was added to verify the fix. - -Daniel (14 September) -- codemastr brought a patch for ares to make the Windows portions of it work - properly on NT4. I uploaded a new diff and updated the docs on where to get - it etc. - -- Jeff Pohlmeyer tracked down a very hard-to-find bug where we removed a - cached DNS entry even though it may be in use, which caused "random" memory - to get overwritten and thus "random" crashes. - -Daniel (12 September) -- Based on a bug report by David Kimdon, I made the runtests.pl script clear - all possible proxy environment variables before the tests are run. - -- By default, easy handles within a multi handle now share DNS cache. - -- Tim Bartley brought a patch that makes the GSSNEGOTIATE option work for - Microsoft's "Negotiate" authentication as well. - -Daniel (11 September) -- A zero-length proxy string confused FTP transfers. - -- Bjorn Reese found a case with an uninitialized pointer, only present when - built for ares. - -Version 7.10.8-pre1 (8 September 2003) - -Daniel (7 September) -- Jurij Smakov found out that the non-OpenSSL MD5 code was not working on - Alpha (or ia64). Only the OpenSSL-version did. I made a fix I think corrects - the problem. - -Daniel (5 September) -- Kevin Fisk reported that configure --enable-thread didn't work. I fixed. - -- De-macrofied the lib/hash.c source code somewhat. - -Daniel (4 September) -- CURLINFO_HTTPAUTH_AVAIL and CURLINFO_PROXYAUTH_AVAIL added, Based on Joerg - Mueller-Tolk's patch, - -Early (4 September) -- Added CURLOPT_FTP_RESPONSE_TIMEOUT - allows user to set strict timeout - requirements on the FTP server's ability to respond to individual commands - without placing global requirements on transfer or connect time. Files - affected: - - include/curl/curl.h - Added option CURLOPT_FTP_RESPONSE_TIMEOUT - - lib/ftp.c - Added branch inside Curl_GetFTPResponse to check for - data->set.ftp_response_timeout - - lib/url.c - Modified Curl_setopt to recognize CURLOPT_FTP_RESPONSE_TIMEOUT - - lib/urldata.h - Added ftp_response_timeout to struct UserDefined - -Daniel (3 September) -- Peter Pentchev found and fixed two problems in the test suite's web server - code, that made it segfault at times. - -- Jörg Mueller-Tolk improved the proxy user+password handling, especially - when providing a blank password. - -Daniel (2 September) -- Fix for making CONNECT to proxies do the correct magic to allow NTLM, Digest - and similar to work. - -Daniel (1 September) -- Henrik Storner made libcurl work fine with OpenLDAP 2.1.22 (current). - -- Jeff Pohlmeyer added a proper error message for non-resolving hosts when - using ares for lookups. - -Daniel (25 August) -- John McGowan reported that curl -k still failed if the HTTPS server's CN - field wasn't obtainable. This was due to the CURLOPT_SSL_VERIFYHOST being - set to 1, and libcurl failed if the CN was missing. Starting now, having it - set to 1 will simply output a warning if no CN could be obtained (as having - a mismatch is OK). - -Daniel (21 August) -- Vincent Sanders provided a fix for name resolving when linked with uClibc. - -Daniel (20 August) -- Gerd v. Egidy provided a patch that makes libcurl store the FTP response - code from ftp servers. Using curl_easy_getinfo() with CURLINFO_HTTP_CODE - returns that data. The option is therefore now also known as - CURLINFO_RESPONSE_CODE. - -- Antoine Calando found a segfault when doing multi-part/formpost using - the multi interface. - -- Antoine Calando pointed out that curl_multi_info_read() didn't set the - msgs_in_queue to 0 properly when returning NULL. - -Daniel (19 August) -- I made curl support multiple -T options, as well as -T "{file1,file2}" - style globbing. One -T for each URL is supported. - -- Jeff Pohlmeyer found a segfault when using ares-enabled libcurl and the - multi interface when trying a non-existing host name. - -- Made the libcurl printf code support long longs if available. - -- Loren Kirkby pointed out that we did not clean up all SSL-allocated memory - in curl_global_cleanup(). - -Daniel (17 August) -- Setting CURLOPT_WRITEFUNCTION or CURLOPT_READFUNCTION to NULL will now make - them get the internal defaults restored. Previously this could cause a - segfault. We should aim at having all pointer-related options get restored - to default/safe values when set to NULL. - -Version 7.10.7 (15 August 2003) - -Daniel (14 August) -- I modified the memdebug system to return failure on memory allocation - functions after a set amount of successful ones. This enables us to test - out-of-memory situations in a controlled manner and we can make sure that - curl/libcurl behaves good in those. - - This made me find and fix several spots where we did not cleanup properly - when bailing out due to errors (low memory). - -- Corrected test case 74. Made using -o with bad #[num] codes complain and - bail out. Made #[num] support numbers larger than 9 as well. Added test - case 86 for a proper range globbing test as well. - -Version 7.10.7-pre4 (12 August 2003) - -Daniel (12 August) -- curl_version_info() now returns a flag if libcurl was built with asynch DNS - support, and this is now also displayed with 'curl -V'. - -- Added a few new man pages to the docs/libcurl dir: curl_share_init, - curl_share_setopt, curl_share_cleanup, libcurl-easy and libcurl-share. - -Daniel (11 August) -- Mike Cherepov made the local binding code work for Windows, which makes - the option CURLOPT_INTERFACE work on Windows as well. - -- Vincent Sanders updated the fopen.c example code a lot. - -- --proxy-ntlm is now supported by the curl tool. It forces the proxy - authentication to be made using NTLM. It does not yet work for HTTPS over - proxies (or other proxy-tunneling options). Test case 81 and 82 do some - simple initial ntlm testing. - -- Found and fixed a minor memory leak on re-used connections with - proxy-authentication. - -- I removed -@ and -Z as valid short options. They were very rarely used (@ - wasn't even documented). - -- Serge Semashko introduced CURLOPT_PROXYAUTH, and make it work when set to - CURLAUTH_NTLM and/or CURLAUTH_BASIC. The PROXAUTH is similar to HTTPAUTH, - but is for the proxy connection only, and HTTPAUTH is for the remote host. - -- Fixed loading of cookies with blank contents from a cookie jar. Also made the - cookie functions inform on added and skipped cookies (for cookie debugging). - -Version 7.10.7-pre3 (8 August 2003) - -Daniel (8 August) -- Applied David Byron's fix for file:// URLs with drive letters included. - -- I added the --ftp-create-dirs to the client code, which activates Early's - CURLOPT_FTP_CREATE_MISSING_DIRS option, and wrote test case 147 to verify - it. Added the option to the curl.1 man page too. Added the option to the - curl_easy_setopt.3 man page too. - -Daniel (7 August) -- Test case 60 failed on ia64 and AMD Opteron. Fixed now. - -- Fixed a printf problem that resulted in urlglobbing bugs (bug #203827 in the - debian bug tracker). Added test case 74 to verify the fix and to discover if - this breaks in the future. - -- "make distcheck" works again. - -Version 7.10.7-pre2 (6 August 2003) - -Daniel (5 August) -- Duncan Wilcox helped me verify that the latest incarnation of my ares patch - builds fine on Mac OS X (see the new lib/README.ares) file for all details. - -- Salvatore Sorrentino filed bug report #783116 and Early Ehlinger posted a - bug report to the libcurl list, both identifying a problem with FTP - persistent connections and how the dir hierarchy was not properly reset - between files. - -- David Byron's thoughts on a fixed Makefile in tests/ were applied. - -- Jan Sundin reported a case where curl ignored a cookie that browsers don't, - which turned up to be due to the number of dots in the 'domain'. I've now - made curl follow the the original netscape cookie spec less strict on that - part. - -Daniel (4 August) -- Dirk Manske added cookie support for the experimental, hidden and still - undocumented share feature! - -- Mark Fletcher provided an excellent bug report that identified a problem - with FOLLOWLOCATION and chunked transfer-encoding, as libcurl would not - properly ignore the body contents of 3XX response that included the - Location: header. - -Early (6 August) -- Added option CURLOPT_FTP_CREATE_MISSING_DIRS - This option will force the target file's path to be created if it - does not already exist on the remote system. - - Files affected: - - include/curl/curl.h - Added option CURLOPT_FTP_CREATE_MISSING_DIRS - - lib/ftp.c - Added function ftp_mkd, which issues a MKD command - Added function ftp_force_cwd, which attempts a CWD, - and does a MKD and retries the CWD if the original CWD - fails - Modified ftp_perform() to call its change directory function - through a pointer. The pointer points to ftp_cwd by default, - and is modified to point to ftp_force_cwd IFF - data->set.ftp_create_missing_dirs is not 0. - - lib/url.c - Modified Curl_setopt to recognize CURLOPT_FTP_CREATE_MISSING_DIRS - - lib/urldata.h - Added ftp_create_missing_dirs to struct UserDefined - -- Minor Bugfix for CURLOPT_TIMECONDITION with FTP - if the file was not - present to do the time comparison, it would fail. - Files affected: - - lib/ftp.c - In ftp_perform(), the call to ftp_getfiletime() used to be followed - by - if (result) - return result; - And then by the code that actually did the time comparison. - The code that did the comparison handled the case where the filetime - was not available (as indicated by info.filetime < 0 or set.timevalue - < 0), so I replaced the if (result) return result with a switch(result) - that allows CURLE_FTP_COULDNT_RETR_FILE to fall through to the - normal time comparison. - -Daniel (3 August) -- When proxy authentication is used in a CONNECT request (as used for all SSL - connects and otherwise enforced tunnel-thru-proxy requests), the same - authentication header is also wrongly sent to the remote host. - - This is a rather significant info leak. I've fixed it now and mailed a patch - and warning to the mailing lists. - -Daniel (1 August) -- David Byron provided a patch to make 7.10.6 build correctly with the - compressed hugehelp.c source file. - -Version 7.10.7-pre1 (31 July 2003) - -Daniel (30 July) -- Jörg Müller-Tolk updated the VC makefile. - -- Daniel Noguerol made the ftp code output "Accept-Ranges: bytes" in similar - style like other faked HTTP headers when NOBODY and HEADER are used. I - updated two corresponding test cases too. - -- Marty Kuhrt pointed out a compilation problem on VMS due to my having - changed a type from long to time_t, and I'm now changing it back to work - more portably... - - He also indicated that distributing the src/hugehelp.c in a compressed state - like I accidentally did may not be the smartest move... I've now fixed the - distribute procedure to automatically generate an uncompressed version when I - make release archives. - -Daniel (29 July) -- Gisle Vanem brought changes to the mkhelp script for the generation of the - compressed help text on some platforms. - -Version 7.10.6 (28 July 2003) - -Daniel (28 July) -- François Pons brought a patch that once again made curl deal with ftp and - "double slash" as indicating the root directory. In the RFC1738-fix of April - 30, that ability was removed (since it is not the "right" way). So, starting - now we can list the root dir of an ftp server both these ways: - - curl ftp://server.com/%2f as well as - curl ftp://server.com// - -Daniel (24 July) -- Henry Bland pointed out that we included sys/resource.h without good reason - in several source files. Without it included, QNX builds better... - -- Andrés García updated the mingw makefiles. - -Daniel (23 July) -- Tracy Boehrer experienced DNS cache problems and did some nice debugging - and tracking which made it easy for me to correct the problem and Tracy - could verify that it did cure the problem! When re-using a connection we - now make sure we don't re-use the 'connect_addr' struct. - -- Daniel Kouril corrected the GSS-Negotiate code. - -- Juan F. Codagnone provided fixes to allow curl to build fine on Windows - again. - -Daniel (22 July) -- Edited the curl/curl.h include file to build on Windows properly. - -Daniel (21 July) -- Moved the proxy credentials from the SessionHandle struct to the connectdata - struct, to make multiple proxy connections with differerent user names work. - -- Adjusted the NTLM code to support proxy functionality. - -- Made the krb4 stuff compile with the user+password fields moved. - -Version 7.10.6-pre4 (21 July 2003) - -Daniel (20 July) -- David Gardner pointed out in bug report 770755 that using the FTP command - CWD with a blank argument is a bad idea and I made libcurl skip empty path - segments starting now. - -Daniel (18 July) -- Cris pointed out that my fix on July 16th didn't work fully. His pointing - out this (and his patch) also made me realize that we have a very similar - bug in the FTP connection re-use code. We must store a separate user and - password field for each connection we keep (at least for FTP and HTTP+NTLM - connections, so I made us do this unconditionally). - -- Since NTLM authenticates connections instead of single requests, I had to - re-arrange how we store the NTLM data and I had to improve the test suite to - finally work properly with persistency to make the NTLM tests run fine - again. This also forced me to have to update lots of HTTP test cases. - -Daniel (16 July) -- Cris Bailiff's bug report 768275 pointed out that using Basic auth with - wrong user+password caused an endless loop. Fixed now. He also found out that - we didn't properly authenticate connections with NTLM. Fixed too. - -- Dan Winship provided fixes for the NTLM code. - -Daniel (5 July) -- Doug Kaufman provided additional fixes for the DOS port. - -Daniel (4 July) -- Rick Richardson pointed out that using setvbuf() to achieve non-buffering - on output is no-good for SCO Xenix and other unixes. We switched over to - using plain fflush() instead. - -- Dan Grayson pointed out that we set the CURL_CA_BUNDLE variable wrongly in - the configure script, and I had to change some build stuff to make the new - way work. - -- Peter Sylvester's patch was applied that introduces the following: - - CURLOPT_SSL_CTX_FUNCTION to set a callback that gets called with the - OpenSSL's ssl_ctx pointer passed in and allow a callback to act on it. If - anything but CURLE_OK is returned, that will also be returned by libcurl - all the way back. If this function changes the CURLOPT_URL, libcurl will - detect this and instead go use the new URL. - - CURLOPT_SSL_CTX_DATA is a pointer you set to get passed to the callback set - with CURLOPT_SSL_CTX_FUNCTION. - -Daniel (1 July) -- David Byron provided a patch that allows a client to quit the test suite's - HTTP server. - -- Gisle Vanem found and patched a lib handle leak in the ldap code. - -Daniel (25 June) -- More NTLM-improvements. Less code. Smaller packets back and forth. - -Daniel (23 June) -- Eric Glass provided us with a better doc on NTLM details, and I added more - comments and clarified the current code more. Using the new knowledge, we - should be able to make the NTLM stuff work even better. - Eric's original URL: https://davenport.sourceforge.io/ntlm.html - Version stored and provided at curl site: https://curl.haxx.se/rfc/ntlm.html - -- Fixed the minor compile problems pre3 had if built without GSSAPI and/or - SSL. - -Version 7.10.6-pre3 (19 June 2003) - -Daniel (19 June) -- Made curl use curl_free() on memory returned by curl_getenv(), as this - should theoreticly make it possibly to build and run curl and libcurl with - different memory allocation schemes with no problems. - -Daniel (18 June) -- Improved the mkhelp.pl a bit further to make a nicer hugehelp text and to - include a better comment in the top for the gzip compressed version. - -Daniel (17 June) -- CURLOPT_HTTPAUTH is now a bitmask, in which you set which authentication - type(s) you want to use. If more than one is set, libcurl will use one of - the selected one and the one it considers is more secure. Test case 67 and - 68 (for NTLM) were fixed and we've reduced a round-trip for specific --ntlm - fetches, and test case 69 and 70 were added for testing authentication - "picking". --anyauth is the new command line tool option, and I also added - --basic for completeness (that's the default type). - -- Fixed the runtests.pl script to use the info provided by the new curl -V - output. - -- --enable-debug now sets the CURLDEBUG define instead of MALLOCDEBUG, as it - is meant to be a generic debug conditional. - -- curl_version_info() can now return CURL_VERSION_DEBUG as a feature bit, to - indicate that the library was built with CURLDEBUG set. - -- Ralph Mitchell found out that some web applications very badly uses white - spaces in Location: redirects, and apparently IE is a browser (the only - one?) that supports this abomination. Based on Ralph's patch, I added code - that now attempts to replace white spaces with the proper "%20" or "+". - Test case 40 and 42 were added to verify my changes. - -- curl -V now also outputs a list of features the available library offers (if - any). - -- The curl_version() string now includes "GSS" if libcurl is built with GSSAPI - support. - -- David Orrell reported that libcurl still crashed when sending HUGE requests - over HTTPS... I fixed. - -Version 7.10.6-pre2 (16 June 2003) - -Daniel (16 June) -- curl_version_info() now returns bitmasked information weather NTLM and - GSSNEGOTIATE are supported, since it is doomed to vary on different - installations. - -- I remade the HTTP Digest code to use the MD5-code provided by OpenSSL if - that is present, and only use our own MD5-code if it isn't. - -Daniel (13 June) -- More NTLM help, fixes and patches from Cris Bailiff. - -- Marty Kuhrt brought include fixes for making VMS builds warning-free. - -Daniel (12 June) -- NTLM authentication works somewhat against the test servers provided by - Mathias Axelsson and Cris Bailiff. Use by setting CURLOPT_HTTPAUTH to - CURLAUTH_NTLM to libcurl, or --ntlm for the curl tool. Test case 67 and 68 - were added for this. NTLM-support requires OpenSSL. - -- Dan Fandrich provided a patch, that granted that gzip and libz are available - at build-time, compresses the hugehelp text in the curl command line and - uncompresses it at request. Saves some ~60K in the final output executable. - -Daniel (11 June) -- Long day of fighting the NTLM demons. - -Daniel (10 June) -- Modified how to set auth type to libcurl. Now use CURLOPT_HTTPAUTH instead, - and pick method. Supported ones currently are: - CURLAUTH_BASIC - default selection - CURLAUTH_DIGEST - formerly CURLOPT_HTTPDIGEST - CURLAUTH_GSSNEGOTIATE - -- Daniel Kouril added HTTP GSS-Negotiate authentication support, as defined in - the IETF draft draft-brezak-spnego-http-04.txt. In use already by various - Microsoft web applications. --negotiate is the new family member. To take - advantage of this, you need one of these packages: - - o Heimdal Kerberos5 http://www.pdc.kth.se/heimdal/heimdal.html - o GSSAPI from Globus http://www.globus.org/ - o GSSAPI libraries from MIT Kerberos5 http://web.mit.edu/kerberos/www/ - -- A missing ending bracket (']') while doing URL globbing could lead to a - segfault. While fixing this, I also introduced better error reporting in the - globbing code. (All this is application code outside libcurl.) - -Daniel (6 June) -- David Orrell found out that sending a huge GET request over HTTPS could - make libcurl fail and return an error code. - -Daniel (2 June) -- Richard Bramante found out that "Content-Length: 0" was not properly used by - libcurl if the response-headers indicated that the connection would be - closed. - -- David Byron's patch was applied, that makes the --progress-bar take the - local size into account when doing resumed downloads. - -- Feedback from Serge Semashko made me change the error message returned when - CURLE_HTTP_RETURNED_ERROR is returned. - -- Anonymous in bug report #745122 pointed out that we should really be using - SSL_CTX_set_options(... SSL_OP_ALL) to work around flaws in existing SSL - implementations. - -Daniel (27 May) -- Andreas Ley and Rich Gray helped me point out that no version of HP-UX has - the sys/select.h header file so including it unconditionally in curl/multi.h - is not a good thing. Now we check for HPUX and avoid using that header on - such systems. - -- Rudy Koento experienced problems with curl's recent habit of POSTing data in - two separate send() calls, first the headers and then the data. I've now - made a fix that for static and known content that is less than 100K in size, - everything is now sent in one single system call again. This is also better - for network performance reasons. - -- I modified the main makefile to not build the test suite and a few other - unnecessary things by default. Now, the test suite is built when 'make test' - is run. This reduces build time for those who don't care for the test - suite, and it also reduces confusion for people using platforms where the - test suite build fails! - -Daniel (26 May) -- Chris Lewis pointed out a flaw in the #ifdefs in curl/multi.h for Windows, - which is now corrected. - -- Jis Joy found another flaw in the SOCK5 code, as libcurl treated the socks5 - proxy a little too much like as if it was a http proxy. - -Daniel (23 May) -- Ricardo Cadime found a socket leak when listing directories without - contents. Test cases 144 and 145 were added to verify the fix. - -- Rudy Koento found yet another problem when a HTTP server returns only a - single-line of contents without any headers at all. libcurl then failed to - count the data, thus returning error 52 "no contents". Test case 66 was - added to verify that we now do right. - -Version 7.10.6-pre1 (23 May 2003) - -Daniel (23 May) -- Jis in bug report #741841, fixed a bug in the SOCKS5 proxy-using code. - -Daniel (22 May) -- David Remahl set up a test-server for me providing Digest authentication, - and I wrote the first working code that support it. The test suite was - modified slightly as well to work better for it and --digest was added to - the command line options (and CURLOPT_HTTPDIGEST to the library)... RFC2617 - has all the gory details. - -Daniel (21 May) -- David Balazic pointed out that curl_unescape() didn't check that %-codes - were correctly followed by two hexadecimal digits when it unescape strings. - Now, we do the check and only %XX codes are unescaped if the X letters are - hexadecimals. - -- Gisle Vanem made curl build with djgpp on DOS. - -- Gisle Vanem improved the mkhelp.pl script to make a nicer manual that is - shown with curl -M. - -Daniel (20 May) -- Gisle Vanem provided a fix that makes libcurl more conservative, not - expecting h_aliases of the hostent struct to always be non-NULL. - -Daniel (19 May) -- As requested by Martin Michlmayr in Debian bug report #193630, libcurl now - supports user name and password in the proxy environment variables. Added - test case 63 to verify this. - -Version 7.10.5 (19 May 2003) - -Daniel (15 May) -- Changed the order for the in_addr_t testing, as 'unsigned long' seems to be - a very common type inet_addr() returns. - -Daniel (14 May) -- George Comninos provided a fix that calls the progress meter when waiting - for FTP command responses take >1 second. It'll make applications more - "responsive" even when dealing with very slow ftp servers. - -Daniel (12 May) -- George Comninos pointed out that libcurl uploads had two quirks: - o when using FTP PORT command, it used blocking sockets! - o it could loop a long time without doing progress meter updates - Both items are fixed now. - -Daniel (9 May) -- Dan Fandrich changed CURLOPT_ENCODING to select all supported encodings if - set to "". This frees the application from having to know which encodings - the library supports. - -- Dan Fandrich pointed out we had three unnecessary files in CVS that is - generated with libtoolize, so they're now removed and libtoolize is invoked - accordingly in the buildconf script. - -- Avery Fay found out that the CURLOPT_INTERFACE way of first checking if the - given name is a network interface gave a real performance penalty on Linux, - so now we more appropriately first check if it is an IP number and if so - we don't check for a network interface with that name. - -- CURLOPT_FTP_USE_EPRT added. Set this to FALSE to disable libcurl's attempts - to use EPRT and LPRT before the traditional PORT command. The command line - tool sets this option with '--disable-eprt'. - -Version 7.10.5-pre2 (6 May 2003) - -Daniel (6 May) -- Kevin Delafield reported another case where we didn't correctly check for - EAGAIN but only EWOULDBLOCK, which caused badness on HPUX. - -Daniel (4 May) -- Ben Greear noticed that the check for 'writable argv' exited the configure - script when run for cross-compiling, which wasn't nice. Now it'll default to - no and output a warning about the fact that it was not checked for. - -Daniel (2 May) -- Added test case 62 and fixed some more on the cookie sending with a custom - Host: header set. - -Daniel (1 May) -- Andy Cedilnik fixed a few compiler warnings. - -- Made the "SSL read error: 5" error message more verbose, by adding code that - queries the OpenSSL library to fill in the error buffer. - -Daniel (30 Apr) -- Added sys/select.h include in the curl/multi.h file, after having been - reminded about this by Rich Gray. - -- I made each test set its own server requirements, thus abandoning the - previous system where the test number implied what server(s) to use for a - specific test. - -- David Balazic made curl more RFC1738-compliant for FTP URLs, by fixing so - that libcurl now uses one CWD command for each path part. A bunch of test - cases were fixed to work accordingly. - -- Cookie fixes: - - A. Save domains in jars like Mozilla does. It means all domains set in - Set-Cookie: headers are dot-prefixed. - B. Save and use the 'tailmatch' field in the Mozilla/Netscape cookie jars - (the second column). - C. Reject cookies using illegal domains in the Set-Cookie: line. Concerns - both domains with too few dots or domains that are outside the currently - operating server host's domain. - D. Set the path part by default to the one used in the request, if none was - set in the Set-Cookie line. - - To make item C really good, I also made libcurl notice custom Host: headers - and extract the host name set in there and use that as the host name for the - site we're getting the cookies from. This allows user to specify a site's - IP-address, but still be able to receive and send its cookies properly if - you provide a valid Host: name for the site. - -Daniel (29 Apr) -- Peter Kovacs provided a patch that makes the CURLINFO_CONNECT_TIME work fine - when using the multi interface (too). - -Version 7.10.5-pre1 (23 Apr 2003) - -Daniel (23 Apr) -- Upgraded to libtool 1.5. - -Daniel (22 Apr) -- Peter Sylvester pointed out that curl_easy_setopt() will always (wrongly) - return CURLE_OK no matter what happens. - -- Dan Fandrich fixed some gzip decompression bugs and flaws. - -Daniel (16 Apr) -- Fixed minor typo in man page, reported in the Debian bug tracker. - -Daniel (15 Apr) -- Fixed some FTP tests in the test suite that failed on my Solaris host, due - to the config.h not being included before the system headers. When done that - way, it did get a mixed sense of if big files are supported or not and then - stat() and fstat() (as used in test case 505) got confused and failed to - return a proper file size. - -- Formposting a file using a .html suffix is now properly set to Content-Type: text/html. - -Daniel (14 Apr) -- Fixed the SSL error handling to return proper SSL error messages again, they - broke in 7.10.4. I also attempt to track down CA cert problems and then - return the CURLE_SSL_CACERT error code. - -- The curl tool now intercepts the CURLE_SSL_CACERT error code and displays - a fairly big and explanatory error message. Kevin Roth helped me out with - the wording. - -Daniel (11 Apr) -- Nic Hines provided a second patch for gzip decompression, and fixed a bug - when deflate or gzip contents were downloaded using chunked encoding. - -- Dan Fandrich made libcurl support automatic decompression of gzip contents - (as an addition to the previous deflate support). - -- I made the CWD command during FTP session consider all 2xy codes to be OK - responses. - -Daniel (10 Apr) -- Vlad Krupin fixed a URL parsing issue. URLs that were not using a slash - after the host name, but still had "?" and parameters appended, as in - "http://hostname.com?foobar=moo", were not properly parsed by libcurl. - -Daniel (9 Apr) -- Made CURLOPT_TIMECONDITION work for FTP transfers, using the same syntax as - for HTTP. This then made -z work for ftp transfers too. Added test case 139 - and 140 for verifying this. - -- Getting the file date of an ftp file used the wrong time zone when - displayed. It is supposedly always GMT. Added test case 141 for this. - -- Made the test suite's FTP server support MDTM. - -- The default DEBUGFUNCTION, as enabled with CURLOPT_VERBOSE now outputs - CURLINFO_HEADER_IN data as well. The most notable effect from this is that - using curl -v, you get to see the incoming "headers" as well. This is - perhaps most useful when doing ftp. - -Daniel (8 Apr) -- James Bursa fixed a flaw in the Content-Type extraction code, which missed - the first letter if no space followed the colon. - -- Magnus Nilsson pointed out that share.c was missing in the MSVC project - file. - -Daniel (6 Apr) -- Ryan Weaver provided a patch that makes the CA cert bundle not get installed - anymore when 'configure --without-ssl' has been used. - -Daniel (4 Apr) -- Martijn Broenland found another cases where a server application didn't - like the boundary string used by curl when doing a multi-part/formpost. We - modified the boundary string to look like the one IE uses, as this is - probably gonna make curl work with more applications. - -Daniel (3 Apr) -- Kevin Roth reported that a bunch of tests fails on cygwin. One set fails - when using perl 5.8 (and they run fine with perl 5.6), and another set - failed because of an artifact in the test suite's FTP server that I - corrected. It turned out the FTP server code was still having a file opened - while the main test script removed it and invoked the HTTP server that - attempted to create the same file name of the file the FTP server kept open. - This operation works fine on unix, but not on cygwin. - -Version 7.10.4 (2 Apr 2003) - -Daniel (1 Apr) -- Added test case 505 to exercise FTP upload with rename done with libcurl, - and for that I had to extend the test suite's FTP server to deal with the - RNFR and RNTO commands. - -Daniel (31 Mar) -- Even more SSL config check modifications after Richard's testing. - -Version 7.10.4-pre6 (31 Mar 2003) - -Daniel (31 Mar) -- More fixes for the SSL session ID cache checks when SSL configs are changed - between connections. Based on tests and talks with Richard Bramante. - -- Guillaume Cottenceau provided a patch that added CURLOPT_UNRESTRICTED_AUTH. - When enabled, it will prevent libcurl from limiting to which host it sends - user+password to when following locations. By default, libcurl only sends - name and password to the original host used in the first URL, but with this - option set it will send the auth info to all hosts it follows location - headers to. The new tool command line option for this is named - "--location-trusted". - -- Frankie Fong reported a problem with libcurl if you re-used an easy handle - with a proxy, and you first made a https:// connection to a host and then - switched to a http:// one to the same host. libcurl would then wrongly re-use - the same connection for it and fail to get the second URL properly - -Daniel (29 Mar) -- Dan Shearer's fix that makes curl complain if invoked with nothing but "curl - -O" was applied. - -Daniel (26 Mar) -- Bryan Kemp was friendly enough to lend me an account on his Redhat 9 box and - I could fix the configure problems on redhat 8.1 and 9 in no time thanks to - this. Thanks a bunch Bryan! - -Daniel (25 Mar) -- Renamed configure.in to configure.ac - -Version 7.10.4-pre5 (25 Mar 2003) - -Daniel (25 Mar) -- Richard Bramante provided a fix for a handle re-use problem seen when you - change options on an SSL-enabled connection between requests. Previously, - changing peer verification or host verification and similar things was not - taken into account when a connection were checked for re-use and thus - enabling stricter check between requests on a re-used connection made no - difference and the connection would thus be used erroneously. - -Daniel (24 Mar) -- Götz Babin-Ebell pointed out that the ca-bundle.crt file contained a - certificate from Trustcenter that was a demo certificate only that was never - intended to be part of a CA bundle. - -Daniel (21 Mar) -- Life is a mystery. Within a time period of 17 hours, Tim Pope and Michael - Churchill filed one bug report each, both identifying problems with a second - transfer when doing persistent transfers re-using a connection. Tim's one is - #706624, labeled "Multiple uploads per handle fail" and Michael's #707003 - "Does not send Authorization: header when reusing connection". I could track - both down to the same piece of logic and it turned out libcurl was not using - new settings properly when re-using an existing connection. This concerned - both uploading and downloading and involved exactly those pieces these two - reports identified. This code has been this faulty since the day I - introduced persistent connection support in libcurl, more than 2 years ago. - -Daniel (20 Mar 2003) -- Five year anniversary. Today five years ago, the first ever curl release saw - the light of day. - -Daniel (17 Mar) -- Andy Cedilnik corrected flaws in some libcurl example-usage sources. - -Daniel (16 Mar) -- Juan F. Codagnone reported that the fix from March 2nd was incomplete. - -- Added code to the configure.in to check for select() argument types. I've - not made any code use the results just yet though. - -Daniel (15 Mar) -- Gisle Vanem provided two patches to build better on Windows. - -- Adjusted the test suite code to better make sure that the server(s) required - for a specific test is properly started before the test case is attempted. - Many tests now run a lot faster than before. - -Daniel (14 Mar) -- Another configure.in adjustment made the configure detect functions properly - on HPUX now. - -Daniel (13 Mar) -- Philippe Raoult fixed pre4-compile quirks for FreeBSD. - -Version 7.10.4-pre4 (13 Mar 2003) - -Daniel (13 Mar) -- Added a backup-check for functions that aren't found by AC_CHECK_FUNCS() - as I believe some checks on HPUX need this. At least some of the info given - to us by Rick Jones seemed to indicate this. - -Daniel (12 Mar) -- Thomas Tonino found out that if you used the curl tool to do PUT operations - as in 'curl www.foo.com/dir/ -T file' and the file name included for example - space or other characters that don't belong in URLs, curl did not properly - URL encode them before using them in the URL. - -- Added an option to configure called --enable-libgcc that simply adds -lgcc - to the LIBS variable, as this seems to be a common problem. - -- I modified the configure.in file, so that the headers are now checked in an - order of "viality". We must also make sure to use the "default headers" - parameter to AC_CHECK_HEADERS() so that headers are checked with the proper - prerequisites included (i.e all the major and generally important header - files are included there by default). This might be what we need for various - Sun, HP, AIX and Tru64 systems to behave good again on the header check - front. - -- Rick Jones pointed out a few compiler warnings on HP-UX that I addressed. - -- I made the configure --help output nicer by using AC_HELP_STRING() a lot - more. - -Daniel (11 Mar) -- Christophe Demory fixed the socket sending code to work better on HP-UX - when sending data to a socket that would block. It then returns EAGAIN, not - EWOULDBLOCK. - -- Richard Gorton improved the seeding function for systems without a good - and reliable random source. - -- Richard Gorton fixed a few warnings that popped up when you built curl - using the Sun compiler on a 64bit SPARC platform. - -- Martin C. Martin fixed a case where a connect failure using the multi - interface didn't produce a human readable error string. - -Daniel (10 Mar) -- Reverted ltmain.sh back to libtool 1.4.2 status again, as the 1.4.3 version - broke the build on numerous platforms. It seems that libtool 1.4.3 puts some - requirements on what versions of the other tools (autoconf + automake) that - I am not familiar with and thus I couldn't fulfill at this point. - - Yes, this is more than mildly frustrating. - -Daniel (7 Mar) -- Run libtoolize version 1.4.3. - -Version 7.10.4-pre3 (4 Mar 2003) - -Daniel (3 Mar) -- Added share.obj to the VC6 and Borland libcurl makefiles. - -- Troels Walsted Hansen found and investigated a problem with libcurl on AIX, - presumably only on 4.3 or later. gethostbyname_r() is not returning data - that is possible to "keep" and cache the way libcurl does. But instead these - versions of AIX uses a gethostbyname() that works thread-safely we can - instead use the ordinary gethostbyname() and our pack_hostent() approach to - achieve what we want. The configure script now attempts to detect AIX 4.3 or - later to adjust for this. - -Daniel (2 Mar) -- Juan F. Codagnone found a problem introduced in 7.10.3 when you first did a - POST and then back to a GET using the same easy handle. - -Daniel (28 Feb) -- Removed the strequal and strnequal defines from curl/curl.h header. They - were never meant for the public header anyway. Philippe Raoult brought it - up. - -- James Bursa fixed the RISC OS build. - -Daniel (27 Feb) -- Avery Fay pointed out the very misleading curl_multi_info_read man page, and - I updated it to become more accurate. - -- Salvatore Sorrentino found a problem with FTP downloading that turned out to - be his FTP server returning size zero (0 bytes) when SIZE was used on a file - while being in BINARY mode. We now make a second check for the actual size - by scanning the RETR reply anyway, even if the SIZE command returned 0. - -Daniel (26 Feb) -- Kyle Sallee reported a case where he would do a transfer that didn't update - the progress meter properly. It turned out to be a case where libcurl would - loop a little too eagerly in the transfer loop, which isn't really good for - the APIs, especially not the multi API. - -Version 7.10.4-pre2 (24 Feb 2003) - -Daniel (24 Feb) -- Kjetil Jacobsen found out that setting CURLOPT_MAXCONNECTS to a value higher - than 5 could cause a segfault. - -- I believe I fixed the 'Expect: 100-continue' behavior that has been broken - for a while (I think since my change dated Dec 10 2002). When this header is - used, libcurl should wait for a HTTP 100 (or timeout) before sending the - post/put data. - -Daniel (14 Feb) -- Matthew Clarke provided some info what to modify to make curl build - flawlessly on AIX 3.2.5. - -- Martin C. Martin found and fixed a problem in the multi interface when - running on Windows and trying to connect to a port without a listener. - -Daniel (13 Feb) -- Christopher R. Palmer fixed Curl_base64_encode() to deal with zeroes in the - data to encode. - -Daniel (4 Feb) -- Jean-Philippe added the first code that enables the 'share' system. This - should now enable sharing of DNS data between two curl easy handles. - -- Incorporated Nico Baggus' fixes to again compile flawlessly on VMS. - -- James Bursa corrected a bad comment in the public include file curl/multi.h - -- Peter Forret reported one of those error:00000000 cases in libcurl again - when connecting to a HTTPS site, and this time I did discover some oddities - in how curl reports SSL errors back. It could miss showing the actual error. - -Version 7.10.4-pre1 (3 Feb 2003) - -Daniel (3 Feb) -- Removed things in the docs saying capath doesn't work on Windows, as Julian - Noble told us it works fine. - -Daniel (31 Jan) -- Kevin Roth fixed the zlib build stuff in the Mingw32 makefile. - -Daniel (30 Jan) -- Kevin Roth found out that curl on Windows always checked for the CA cert - bundle using the environment variable and the path scan, even though - -k/--insecure was used. - -- Hamish Mackenzie pointed out that curl only did strict host name verifying - if capath or cainfo was used. Now it'll always do it unless -k / --insecure - is used! - -- Pavel Cenek pointed out that the Content-Type extraction was done wrongly - as the full string was not fetched. Added test case 57 to verify that curl - does it right now. - -Daniel (29 Jan) -- Jamie Wilkinson provided a patch that now makes curl attempt to clear out - "sensitive" command line arguments so that they don't appear in ps outputs - (only on platforms that allow writing to argv[]). - -- John McGowan found out that the DEBUGFUNCTION could be called with bad - arguments and thus cause the --trace outputs to go wrong. - -- Removed all the emacs local variables from all files. Mats Lidell provided - the new sample.emacs file (for a sample of what to include in your .emacs) - and the curl-style.el that sets a better c-style for editing curl sources. - -- Dave Halbakken found a problem with FTP downloads that could accidently - return CURLE_PARTIAL_FILE when curl_easy_perform() was called with NOBODY - set TRUE. - -Daniel (27 Jan) -- The fopen.c example was flawed as Nick Humfrey noticed, and I fixed it to - work again. - -Daniel (24 Jan) -- Bertrand Demiddelaer found and fixed a memory leak (the content-type string) - when following locations. - -Daniel (22 Jan 2003) -- Ian Wilkes and Legoff Vincent both independently provided fixes for making - curl/multi.h work properly when compiled with a C++ compiler. - -Daniel (20 Jan 2003) -- Fixed 'buildconf' to check version number of the required tools before - they're actually used. - -- Wrote 'testcurl.sh', a script targeted for automatic and distributed curl - tests on various platforms. - -- David Thiel pointed out that the .netrc file was not being dealt with - properly anymore. I broke this in the password prompting "fix". - -- Markus F.X.J. Oberhumer patched libcurl to allocate the scratch buffer only - on demand and thus we save 32KB in each curl handle that don't use that - buffer. This need appeared when some people started using thousands of - simultaneous curl handles... :-) - -Daniel (16 Jan 2003) -- Markus Oberhumer fixed curl-config --cflags when the includedir was not - /usr/include. - -- Markus Oberhumer fixed CURLINFO_PRIVATE to properly return NULL if it was - set to NULL! - -Version 7.10.3 (14 Jan 2003) - -Daniel (10 Jan 2003) -- Steve Oliphant pointed out that test case 105 did not work anymore and this - was due to a missing fix for the password prompting. - -Version 7.10.3-pre6 (10 Jan 2003) - -Daniel (9 Jan 2003) -- Bryan Kemp pointed out that curl -u could not provide a blank password - without prompting the user. It can now. -u username: makes the password - empty, while -u username makes curl prompt the user for a password. - -- Kjetil Jacobsen found a remaining connect problem in the multi interface on - ipv4 systems (Linux only?), that I fixed and Kjetil verified that it fixed - his problems. - -- memanalyze.pl now reads a file name from the command line, and no longer - takes the data on stdin as before. - -Version 7.10.3-pre5 (9 Jan 2003) - -Daniel (9 Jan 2003) -- Fixed tests/memanalyze.pl to work with file names that contain colons (as on - Windows). - -- Kjetil Jacobsen quickly pointed out that lib/share.h was missing... - -Version 7.10.3-pre4 (9 Jan 2003) - -Daniel (9 Jan 2003) -- Updated lib/share.c quite a bit to match the design document at - https://curl.haxx.se/dev/sharing.txt a lot more. - - I'll try to update the document soonish. share.c is still not actually used - by libcurl, but the API is slowly getting there and we can start - implementing code that takes advantage of this system. - -Daniel (8 Jan 2003) -- Updated share stuff in curl/curl.h, including data types, structs and - function prototypes. The corresponding files in lib/ were also modified - of course to remain compilable. Based on input from Jean-Philippe and also - to make it more in line with the design document. - -- Jean-Philippe Barrette-LaPierre patched a very trivial memory leak in - curl_escape() that would happen when realloc() returns NULL... - -- Matthew Blain provided feedback to make the --create-dirs stuff build - properly on Windows. - -- Fixed the #include in tests/libtest/first.c as Legoff Vincent pointed out. - -Daniel (7 Jan 2003) -- Philippe Raoult provided a patch that now makes libcurl properly support - wildcard checks for certificate names. - -- Simon Liu added CURLOPT_HTTP200ALIASES, to let an application set other - strings recognized as "HTTP 200" to allow http-like protocols to get - downloaded fine by curl. - -- Now using autoconf 2.57 and automake 1.7.2 - -- Doing "curl -I ftp://domain/non-existing-file" still outputed a date! - Wayne Haigh reported. - -- The error message is now written properly with a newline in the --trace - file. - -Daniel (6 Jan 2003) -- Sterling Hughes fixed a possible bug: previously, if you called - curl_easy_perform and then set the global dns cache, the global cache - wouldn't be used. Pointed out by Jean-Philippe Barrette-LaPierre. - -- Matthew Blain's fixed the VC6 libcurl makefile to include better debug data - on debug builds. -Daniel (27 Dec 2002) -- Philippe Raoult reported a bug with HTTPS connections which I evidently - added in my 19 dec fix. I corrected it. - -Daniel (20 Dec) -- Idea from the Debian latest patch: use AM_MAINTAINER_MODE in the configure - script to make the default makefile less confusing "to the casual - installer". - -Version 7.10.3-pre3 (20 Dec) - -Daniel (19 Dec) -- Matthew Blain patched the Curl_base64_decode() function. - -- Evan Jordan reported in bug report #653022 that the SSL_read() usage was - wrong, and it certainly was. It could lead to curl using too much CPU due to - a stupid loop. - -Daniel (18 Dec) -- As suggested by Margus Freudenthal, CURLE_HTTP_NOT_FOUND was renamed to - CURLE_HTTP_RETURNED_ERROR since it is returned on any >= 400 code when - CURLOPT_FAILONERROR is set. - -Daniel (17 Dec) -- Bug reported #651464, reported by Christopher Palmer, provided an example - source code using the multi interface that hang when trying to connect to a - proxy on a localhost port where no proxy was listening. This bug was not - repeatable on libcurls that were IPv6-enabled. - -Daniel (16 Dec) -- Christopher Palmer also noticed what Vojtech Janota already was - experiencing: The attempted name resolve fix for glibc 2.2.93 caused libcurl - to crash when used on some older glibc versions. The problem is of course - the silliness of the 2.2.93. I committed a fix that hopefully should make - the binary run fine on either one of the versions, even though the solution - is not as nice as I'd like it to be. - -Daniel (13 Dec) -- Bug report #651460 by Christopher R. Palmer showed that when using libcurl - to for example go over a proxy on localhost, it would attempt to connect - through the proxy TWICE. - - I added test case 503 with which I managed to repeat this problem and I - fixed the code to not re-attempt any connects (which also made it a nicer - fix for the #650941 bug mentioned below). - - The sws server was extended to deal with CONNECT in order to make test - case 503 do good. - -- Evan Jordan posted bug report #650989 about a memory leak in the public key - retrieving code. He provided a suggested fix and I merely applied it! - -- Bug report #650941, posted by Christopher R. Palmer identified a problem - with the multi interface and getting file:// URLs. This was now fixed and - test case 502 was added to verify this. - -Daniel (12 Dec) -- Test case 500 and 501 are the first ever libcurl test cases that run. - -- Made "configure --enable-debug" cut off all -O* options to the compiler - -- Finally fixed the test suite's ftp server so that test case 402 doesn't - cause the following test case to fail anymore! - -Daniel (11 Dec) -- CURL_MAX_WRITE_SIZE is now decreased to 16KB since it makes the Windows - version perform uploads much faster!!! RBramante did lots of research on - this topic. - -- Fixed the #include in curl/curl.h to include the other files outside the - extern "C" scope. - -Daniel (10 Dec) -- Moved around and added more logic: - - First, POST data is never sent as part of the request headers in the http.c - code. It is always sent the "normal" read callback then send() way. This now - enables a plain HTTP POST to be sent chunked if we want to. This also - reduces the risk of having very big POSTs causing problems. - - Further, sending off the initial HTTP request is not done using a loop - anymore. If it wasn't all sent off in the first send(), the rest of the - request is sent off in the normal transfer select() loop. This makes several - things possible, but mainly it makes libcurl block less when used from the - multi interface and it also reduces the risk of problems with issuing very - large requests. - -Daniel (9 Dec) -- Moved the read callback pointer and data within the structs to a more - suitable place. This in preparation for a better HTTP-request sending code - without (a silly) loop. - -- The Dodds fix seems not to work. - -- Vojtech Janota tests proved that the resolve fix from oct 21st is not good - enough since obviously older glibcs might return EAGAIN without this meaning - that the buffer was too small. - -- [the other day] Made libcurl loop on recv() and send() now until done, and - then get back to select(). Previously it went back to select() more often - which really was a slight overhead. This was due to the reported performance - problems on HTTP PUT on Windows. I couldn't see any notable difference on - Linux... - -Version 7.10.3-pre2 (4 Dec 2002) - -Daniel (4 Dec 2002) -- Lots of work with Malcolm Dodds made me add a temporary code fix that now - shortens the timeout waiting for the 226 or 250 line after a completed - FTP transfer. - - If no data is received within 60 seconds, this is taken as a sign of a dead - control connection and we bail out. - -Daniel (3 Dec 2002) -- Ralph's bug report #644841 identified a problem in which curl returned a - timeout error code when in fact the problem was not a timeout. The proper - error should now be propagated better when they're detected in the FTP - response reading function. - -- Updated the Borland Makefiles. - -Daniel (2 Dec 2002) -- Nicolas Berloquin provided a patch that introduced --create-dirs to the - command line tool. When used in combination with -o, it lets curl create - [non-existing] directories used in -o, suitably used with #-combinations - such as: - - curl "www.images.com/{flowers,cities,parks,mountains}/pic_[1-100].jpg \ - -o "dir_#1/pic#2.jpg" --create-dirs - -Version 7.10.3-pre1 - -Daniel (28 Nov 2002) -- I visited Lars Nordgren and had a go with his problem, which lead me to - implement this fix. If libcurl detects the added custom header - "Transfer-Encoding: chunked", it will now enable a chunked transfer. - - Also, chunked transfer didn't quite work before but seems to do so now. - -- Kjetil Jacobsen pointed out that ./configure --disable-ipv6 --without-zlib - didn't work on any platform... - -Daniel (26 Nov 2002) -- Fixed a bad addrinfo free in the hostip.c code, hardly exposed anywhere - -- Dan Becker found and fixed a minor memory leak on persistent connnections - using CURLOPT_USERPWD. - -Daniel (22 Nov 2002) -- Based on Ralph Mitchell's excellent analysis I found a bug in the test suite - web server (sws) which now lets test case 306 run fine even in combination - with the other test cases. - -- Juan Ignacio Hervás found a crash in the verbose connect message that is - used on persistent connections. This bug was added in 7.10.2 due to the - rearranged name resolve code. - -Daniel (20 Nov 2002) -- Kjetil Jacobsen provided a patch that introduces: - - CURLOPT_PRIVATE stores a private pointer in the curl handle. - - CURLINFO_PRIVATE retrieves the private pointer from the curl handle. - -- Karol Pietrzak pointed out how curl-config --cflags didn't output a good - include dir so I've removed that for now. - -Version 7.10.2 (18 Nov 2002) - -Daniel (11 Nov 2002) -- Dave Halbakken added curl_version_info to lib/libcurl.def to make libcurl - properly build with MSVC on Windows. - -Daniel (8 Nov 2002) -- Doing HTTP PUT without a specified file size now makes libcurl use - Transfer-Encoding: chunked. - -Daniel (7 Nov 2002) -- Bug report #634625 identified how curl returned timeout immediately when - CURLOPT_CONNECTTIMEOUT was used and provided a fix. - -Version 7.10.2-pre4 (6 Nov 2002) - -Daniel (5 Nov 2002) -- Lehel Bernadt found out and fixed. libcurl sent error message to the debug - output when it stored the error message. - -- Avery Fay found some problems with the DNS cache (when the cache time was - set to 0 we got a memory leak, but when the leak was fixed he got a crash - when he used the CURLOPT_INTERFACE with that) that had me do some real - restructuring so that we now have a reference counter in the dns cache - entries to prevent an entry to get flushed while still actually in use. - - I also detected that we previously didn't update the time stamp when we - extracted an entry from the cache so that must've been a reason for some - very weird dns cache bugs. - -Version 7.10.2-pre3 - -Daniel (31 Oct 2002) -- Downgraded automake to 1.6.3 in an attempt to fix cygwin problems. (It - turned out this didn't help though.) - -- Disable the DNS cache (by setting the timeout to 0) made libcurl leak - memory. Avery Fay brought the example code that proved this. - -Version 7.10.2-pre2 - -Daniel (28 Oct 2002) -- Upgraded to autoconf 2.54 and automake 1.7 on the release-build host. - -- Kevin Roth made the command line tool check for a CURL_CA_BUNDLE environment - variable (if --cacert isn't used) and if not set, the Windows version will - check for a file named "curl-ca-bundle.crt" in the current directory or the - directory where curl is located. That file is then used as CA root cert - bundle. - -- Avery Fay pointed out that curl's configure scrip didn't get right if you - used autoconf newer than 2.52. This was due to some badly quoted code. - -Version 7.10.2-pre1 - -Daniel (23 Oct 2002) -- Emiliano Ida confirmed that we now build properly with the Borland C++ - compiler too. We needed yet another fix for the ISO cpp check in the curl.h - header file. - -- Yet another fix was needed to get the HTTP download without headers to work. - This time it was needed if the first "believed header" was read all in the - first read. Test 306 has not run properly since the 11th october fix. - -Daniel (21 Oct 2002) -- Zvi Har'El pointed out a problem with curl's name resolving on Redhat 8 - machines (running IPv6 disabled). Mats Lidell let me use an account on his - machine and I could verify that gethostbyname_r() has been changed to return - EAGAIN instead of ERANGE when the given buffer size is too small. This is - glibc 2.2.93. - -- Albert Chin helped me get the -no-undefined option corrected in - lib/Makefile.am since Cygwin builds want it there while Solaris builds don't - want it present. Kevin Roth helped me try it out on cygwin. - -- Nikita Schmidt provided a bug fix for a FOLLOWLOCATION bug introduced when - the ../ support got in (7.10.1). - -Daniel (18 Oct 2002) -- Fabrizio Ammollo pointed out a remaining problem with FOLLOWLOCATION in - the multi interface. - -Daniel (17 Oct 2002) -- Richard Cooper's experimenting proved that -j (CURLOPT_COOKIESESSION) didn't - work quite as supposed. You needed to set it *before* you use - CURLOPT_COOKIEFILE, and we dont' want that kind of dependencies. - -Daniel (15 Oct 2002) -- Andrés García provided corrections for erratas in four libcurl man pages. - -Daniel (13 Oct 2002) -- Starting now, we generate and include PDF versions of all the docs in the - release archives. - -Daniel (12 Oct 2002) -- Trying to connect to a host on a bad port number caused the multi interface - to never return failure and it appeared to keep on trying forever (it just - didn't do anything). - -Daniel (11 Oct 2002) -- Downloading HTTP without headers didn't work 100%, some of the initial data - got written twice. Kevin Roth reported. - -- Kevin Roth found out the "config file" parser in the client code could - segfault, like if DOS newlines were used. - -Version 7.10.1 (11 Oct 2002) - -Daniel (10 Oct 2002) -- Jeff Lawson fixed a few problems with connection re-use that remained when - you set CURLOPT_PROXY to "". - -Daniel (9 Oct 2002) -- Craig Davison found a terrible flaw and Cris Bailiff helped out in the - search. Getting HTTP data from servers when the headers are split up in - multiple reads, could cause junk data to get inserted among the saved - headers. This only concerns HTTP(S) headers. - -Daniel (8 Oct 2002) -- Vincent Penquerc'h gave us the good suggestion that when the ERRRORBUFFER - is set internally, the error text is sent to the debug function as well. - -- I fixed the telnet code to timeout properly as the option tells it to. On - non-windows platforms. - -Daniel (7 Oct 2002) -- John Crow pointed out that libcurl-the-guide wasn't included in the release - tarball! - -- Kevin Roth pointed out that make install didn't do right if build outside - the source tree (ca-bundle wise). - -- FOLLOWLOCATION bugfix for the multi interface - -Daniel (4 Oct 2002) -- Kevin Roth got problems with his cygwin build with -no-undefined was not - present in lib/Makefile.am so I put it back in there again. The poor one who - needs to remove it again must write a configure script to detect that need. - -- Ralph Mitchell pointed out that curl was a bit naive and didn't deal with ./ - or ../ stuff in the string passed back in a Location: header when following - locations. - -- Albert Chin helped me to work out a better configure.in check for zlib, and - both --without-zlib and -with-zlib seem to work rather well right now. - -- Zvi Har'El improvied the OpenSSL ENGINE check in the configure script to - become more accurate. - -Daniel (1 Oct 2002) -- Detlef Schmier pointed out the lack of a --without-libz option to configure, - so I added one. - -Version 7.10 (1 Oct 2002) - -Daniel (30 Sep 2002) -- Modified the curl_version_info() proto and returned struct once again, and - updated the man page accordingly. - -- Cris Bailiff found out that the pre-releases crashed on name lookups on - names such as "a:" or "baz:" (on Linux versions not being IPv6-enabled) due - to some weird return codes from gethostbyname_r(). I'll blame the complete - lack of docs in that department. Cris provided a fix, which I modified only - slightly. - -Daniel (27 Sep 2002) -- After a suggestion from Christian Kurz to Debian curl package maintainer - Domenico Andreoli, I made it possible to override the proxy environment - variables better. Now, by setting -x "" you can explicitly tell libcurl to - not use a proxy, no matter whan the environment variables say. - -Version 7.10-pre4 - -Daniel (26 Sep 2002) -- Extended curl_version_info() more and wrote a man page for it. - -Daniel (25 Sep 2002) -- libcurl could leak memory when downloading multiple files using http ranges, - reported and fixed by Jean-Luc Guevel. - -- Walter J. Mack provided code and docs for the new curl_free() function that - shall be used to free memory that is allocated by libcurl and returned back - to the application, as curl_escape() and curl_unescape() do. - -- Yarram Sunil pointed out a flaw in the multi interface where a failed - connection didn't close down properly and thus a second transfer using the - same handle failed. - -- Andrés García fixed a flaw that made (among other things) dict-fetches - return a random value. - -Daniel (24 Sep 2002) -- Wez Furlong brought his initial patch that introduced curl_version_info(). - We might need to tweak it somewhat before release. - -Daniel (20 Sep 2002) -- Craig Markwardt fixed another Tru64 IP resolve problem. - -Daniel (19 Sep 2002) -- Dolbneff A.V and Spiridonoff A.V made the file:// code work with resumes - in the same style other code does. - -- Ilguiz Latypov fixed a flaw in the client code when fetching multiple URLs - and -C - was used. The first file's resume position was then accidentally - reused on all the other files too. - -Daniel (18 Sep 2002) -- The curl_easy_setopt.3 man page was greatly modified and the options have - now been grouped in logical groups so that it should be somewhat easier to - read it and find things you search for. - -Daniel (13 Sep 2002) -- Kevin Roth pinpointed a scary flaw in libcurl, when the HTTP server doesn't - send any headers back, only raw content. Right, that is a violation of the - standard but still happens at times and we need to deal with it. Test case - 306 was added to verify that we do right now. - -Version 7.10-pre3 - -Daniel (11 Sep 2002) -- Lukasz Czekierda found out that curl didn't send a correct HTTP Host: header - when you specified the URL with an IPv6 IP-address. - -Daniel (4 Sep 2002) -- Sven Neuhaus made --silent being acknowledged even when multiple URLs - were used. It used to output "[1/2]: http://host/a.html.de --> a.html.d" etc - even when told to shut up. - -Daniel (3 Sep 2002) -- Updated all source code headers to use MIT-license references only, and - point to the COPYING file and the https://curl.haxx.se/docs/copyright.html - URL. I've cut out all references to MPL that I could find. - -- Corected the makefiles to not always use -lz when linking - -Version 7.10-pre2 - -Daniel (2 Sep 2002) -- James Gallagher added Content-Encoding support to libcurl so now curl and - libcurl-using apps can request compressed contents using the 'deflate' - method. See the special file lib/README.encoding for details. - - curl --compressed is now used to request compressed contents. - - curl-config --feature will include 'libz' if this feature was around when - the library was built. - -Daniel (30 Aug 2002) -- Applied an anonymous SOCKS5-proxy patch. Not properly working in all - situations though, as all getaddrinfo()-using libcurls will fail on this. - This is because of the somewhat naive way the current code tries to extract - the IP address of the proxy. - -- Fixed up the SSL cert fixes from the other day even more after more inputs - from Cris. Added three new SSL error codes to make the - CURLE_SSL_CONNECT_ERROR slightly less overloaded. - -Daniel (27 Aug 2002) -- After lots of talk with Tom Zerucha, Nick Gimbrone and Cris Bailiff I - decided to talk the bold path and I now made libcurl do CA certificate - verification by default. Thus library users need to explicitly turn this off - if you want to connect to sites without proper checking. We also install a - CA cert bundle on 'make install' now. - - The curl tool now requires the -k/--insecure option in order to allow - connections and operations on SSL sites that aren't properly verified with - -cafile or --capath. - - curl-config --ca displays the built-in path to the CA cert bundle. - -Daniel (26 Aug 2002) -- Andrew Francis cleaned up some code that now compiles fine without the need - for ugly MSVC pragmas. - -- Keith MacDonald found a minor bug in src/main.c that made it close stdin - instead of the actual file handle. It shouldn't have resulted in much - trouble as most operating systems close all file handles on process exit - anyway. - -Daniel (22 Aug 2002) -- Markus Oberhumer provided some documentation for his previously provided - CURLOPT_NOSIGNAL fix. - -- Patched the lib/Makefile.am to hopefully no longer complain on undefined - symbols that seemed to occur on builds with shared OpenSSL libraries on - Solaris lately... - -Daniel (20 Aug 2002) -- Fixed compiler warnings on MSCV++ compiles. We're looking for help here: - remove the pragmas from lib/config-win32.h and adjust the sources where - the warnings occur. Hiding them with pragmas like this is not the correct - way of dealing with compiler warnings. - -Daniel (13 Aug 2002) -- Ulrich Zadow made the global include files in curl/* include themselves - using "curl.h" instead of <curl/curl.h> which thus allows people to more - freely decide how to include curl and how to setup their include paths. - -- Sterling Hughes added the curl_share* interface, somewhat as discussed - previously. - -- Jörn Hartroth pointed out that poll() was used in the pre1 source code and - it isn't very portable, so now I check for it in the configure script and - work around it. - -Version 7.9.9-pre1 - -Daniel (12 Aug 2002) -- Applied my initial take on making the multi stuff more asynchronous. Connects - should now return back without "hanging" until it has connected for real. - This should also be the case for FTP-PASV connects. - -Daniel (9 Aug 2002) -- Applied Markus F.X.J. Oberhumer's patch that introduces CURLOPT_NOSIGNAL, - which effectively prevents libcurl from doing anything that may cause - signals to get sent. This is basicly for multi-threaded applications that - now can use timeouts properly, without risking any signals to burst in and - ruin the party. - -Daniel (5 Aug 2002) -- Lukasz Czekierda reported that RFC2732-style literal IPv6 addresses didn't - work. When did that code vanish? Anyway, it's back again now and seems to - work! - -- Jonatan Lander found out that POSTing an empty string didn't work with the - command line tool. - -Daniel (3 Aug 2002) -- Jörn Hartroth fixed the libcurl.def file to build the windows DLL with - the multi interface enabled. - -Daniel (1 Aug 2002) -- The ftp PORT command now uses a better default IP address, as it will - extract and use the local IP address used by the control connection. - -- Modified the #include lines in curl/multi.h to work better on more - platforms. - -Daniel (31 Jul 2002) -- Attempted a fix for Ray DeGennaro's reported HP-UX host name resolve - problems. - -Daniel (30 Jul 2002) -- Priya Ramakrishnan and Ryan Jones compiles curl/curl.h with a C++ compiler - and don't get __STDC__ defined, which required us to extend the preprocessor - check for the ## operator usage. - -- Correct the description for CURLOPT_PASSWDFUNCTION, if set to NULL the - internal default function will be put back. - -- danfuzz at milk.com found out that libcurl badly assumed a space after - 'Set-Cookie:' so if it wasn't present, it caused the first letter of the - cookie name to fall off! - -Daniel (29 Jul 2002) -- The password prompt asking for user password used stdout and now uses - stderr instead to better allow redirecting. It also leaked a fopen() file - handle that is now fixed. - -Daniel (28 Jul 2002) -- HAVE_SETVBUF was left out from src/main.c which made -N not work. Found out - by M T. - -Daniel (26 Jun 2002) -- Glen Nakamura solved a crash in the name resolving function for IP-only - addresses on Alpha Linux (at least). - -- T. Bharath corrected the high resolution timer introduced in 7.9.8. - -Daniel (22 Jun 2002) -- Andrés García pointed out man page errors in curl_formadd.3. I fixed. - -Daniel (19 Jun 2002) -- Chris Combes pointed out a flaw in curl_escape(). I fixed. We no longer - tries to generate nor parse '+' in URLs. Spaces become %20, and only %-codes - are translated by curl_unescape(). - -Daniel (15 Jun 2002) -- Added --limit-rate to the curl tool. Allows the user to set a maxmimum - upper limit to how much bandwidth to use for transfers. - -- CURLOPT_BUFFERSIZE was added to libcurl. This sets a prefered size for the - receive buffer in libcurl. The main point of this would be that the write - callback gets called more often and with smaller chunks. - -Daniel (14 Jun 2002) -- Yarram Sunil found out that the SocketIsDead() function performed a lot - faster on Windows when removing the 1 microsecond timeout. - -- Hanno L. Kranzhoff fixed the VC++ project files. - -- Tom Mattison found out that ftp transfers closed the connection a little - too often. - -- Miklos Nemeth posted a VC++ makefile fix and some INSTALL comments on how - to disable specific protocols when building for Windows. - -Version 7.9.8 - -Daniel (13 Jun 2002) -- Time to let this baby go. - -Daniel (12 Jun 2002) -- Chris Combes added three new options for curl_formadd(): CURLFORM_BUFFER, - CURLFORM_BUFFERPTR, CURLFORM_BUFFERLENGTH. They are used to create a - multipart that appears as a regular file upload, but the data is provided - with a pointer and length. - -- Nico Baggus made the VMS version use sigsetjmp() too. - -- Jörn Hartroth fixed the mingw32 build using the mm lib. - -- Applied patches by Kris Kennaway that correct format string problems in - lib/ftp.c and lib/ldap.c. - -Version 7.9.8-pre3 - -Daniel (11 Jun 2002) -- James Cone brought the idea of using sigsetjmp() in the signal handler to - make the time-out of name lookups to work, even when the underlying name - resolver library traps EINTR. The use of sigsetjmp() and siglongjmp() for - this may be a bit drastic, and also not likely to exist on all platforms. I - added careful checking for this in the configure script, even checks for it - being a macro (which seems to be the case in for example Linux). - - sigsetjmp() seems to be mentioned in the Single Unix specification. - -- Miklos Nemeth brought a patch that allows libcurl to get built with specific - protocols disabled. This is done by running ./configure - --disable-[protocol]. - -- FTP range downloads could make CURLE_FTP_WRITE_ERROR get returned. We now - make precautions to not return this for range downloads. - - Added test case 135 that makes an ftp range download. Had to tweak the - runtests.pl script a bit too. - -- Bug report #566835 identified a strlen() on a NULL pointer. Added additional - check to prevent this. - -Daniel (10 Jun 2002) -- Found and corrected a connect failure problem that didn't create a human - error text. - -- Added code to compile with OpenSSL 0.9.7. Based on patch from Jacob Meuser - and comments from Götz Babin-Ebell. - -- Gautam Mani found a socket descriptor leak that happened when FTP transfers - failed and you reinvoked curl_easy_perform(). - -Daniel (5 Jun 2002) -- Gustaf Hui corrected curl_multi_remove_handle() so that it won't crash no - matter when you decide to remove the CURL handle. - -- HAVE_RAND_STATUS was added to lib/config-win32.h by Andreas Olsson, as it - makes windows builds stop complaining about "weak seeding" when it in fact - isn't. - -- Another 64bit architecture crash that was introduced in 7.9.7 was now - removed, as bug report #564585 clarified. This happened due to our attempts - to only allocate only as much memory as is actually needed for name - resolving (using realloc) which called for a function that could 'move' a - hostent struct in memory. - -Version 7.9.8-pre2 - -Daniel (3 Jun 2002) -- T. Bharath fixed the CURLINFO_REDIRECT_TIME to return a correct time and - made the CURLINFO_REQUEST_SIZE return the correct total request size. He - also made the win32 timers use higher resolution than before. - -Daniel (29 May 2002) -- Renaud Chaillat made me aware of the fact that libcurl returned an error if - you tried to get an empty FTP file. This seemed like a wrong thing to do, so - now it no longer does that! I just hope that no one built anything fancy - upon this unexpected behavior... - -Daniel (28 May 2002) -- Cris Bailiff brought CURLOPT_CAPATH that works like CURLOPT_CAINFO but - specifies a path to a directory with certificates rather than a single file - with them all concatenated. --capath was added to the command line tool - for the same function. - - Windows users need to pay attention that the directory should be setup with - the c_rehash tool of the OpenSSL package, and that creates symlinks by - default that need to be replaced with actual copies to work on Windows. - -- Gustaf Hui provided new code that changes how curl_multi_info_read() - messages are stored, so that they don't have to be kept around for the multi - handle's entire life time. He also made it return failure codes properly - which it didn't do before. - -Daniel (27 May 2002) -- Gustaf Hui pointed out that running curl_multi_perform() without doing - curl_multi_fdset() first was not really a working combo. I added an internal - check for this and have some extra select() code without timeout to make the - library internals work identically nevertheless. We might need to somehow - either document that once you've used the *_fdset() you should remain using - them in select() or you should blank them somehow so that libcurl won't go - crazy. - -Version 7.9.8-pre1 - -Daniel (22 May 2002) -- James Cone brought an excellent patch, including several tests and docs! - CURLOPT_NETRC now takes an enum as argument instead of the previous boolean. - --netrc-optional was introduced as an addition to --netrc to allow the - command line client to take use of all that new netrc stuff. - -- Bug report #558888 showed a case where libcurl re-used the previous host - name when a connection over a proxy was re-used but to a different target - host. - -Daniel (21 May 2002) -- Edin Kadribasic helped me sort out a problem to made libcurl crash when - trying to HTTP POST an empty string. - -- Clarified that Juergen Wilke donated the original tests/server/sws.c code. - -- Jean-Philippe Barrette-LaPierre made curl_formadd() return a typedef named - CURLFORMcode instead of the previous 'int', and the various return codes are - now globally exported. It allows applications to better figure out what goes - wrong when curl_formadd() returns errors. - -Daniel (20 May 2002) -- Roland Zimmermann pointed out that SSL_CTX_use_certificate_chain_file() - is prefered to SSL_CTX_use_certificate_file(). - -Daniel (17 May 2002) -- Bug report #556869 pointed out that src/writeout.c didn't compile on freebsd - after my AIX fixes the other week. - -- Bug report #556930 pointed out a FreeBSD core dump introduced in 7.9.7 in - the DNS struct realloc stuff. Actually, this crash could happen on all - systems that made the pack_hostent() function get invoked. - -- I removed several compiler warnings in the test suite's HTTP server. - -Version 7.9.7 - -Daniel (10 May 2002) -- Kevin Roth adjusted the --trace-ascii output slightly. - -- Paul Harrington found out that src/writeout.c needed an additional header - file included for AIX builds - -Version 7.9.7-pre2 - -Daniel (7 May 2002) -- Updated the man page with --trace-ascii and -j/--junk-session-cookies. - -- Made --trace-ascii do pretty much the same as --trace but without the hex - part in the output. - -- Added CURLOPT_COOKIESESSION that when enabled makes libcurl ignore session - cookies read from a file. This option is enforced by the curl command line - tool using the new -j/--junk-session-cookies option. After discussions with - Kevin Roth. This makes it easier to use curl to fully emulate a browser's - behavior, even when it comes to "session cookies". Session cookies are - cookies that a normal browser discards when the browser is shut - down. They're identified by not having any expire date/time. - -- When CURLOPT_DEBUGDATA was set, it ruined the CURLOPT_STDERR setting and - this was discovered when --trace was made to crash. - -- Using -v and --trace at the same time confused matters. -v is now pretty - much ignored when --trace or --trace-ascii is used. - -- Made --trace (and --trace-ascii) support - as file name to pass output to - stdout instead. It makes it consistent with how other options work. - -Version 7.9.7-pre1 - -Daniel (6 May 2002) -- Added multi-post.c to the examples directory. I got the basic source for - this from Gustaf Hui. - -Daniel (3 May 2002) -- CURL_MAX_WRITE_SIZE is now an exported #define in the curl/curl.h header and - can be used to figure out the maximum buffer size your write callback can - get. - -- CURLOPT_READDATA is now an alias for CURLOPT_INFILE and CURLOPT_WRITEDATE is - an alias for CURLOPT_FILE. These two were added for conformity. Most other - callback function's userdata are provided with options using a similar name- - scheme. - -- Added "--trace [file]" to the command line tool. It makes a very detailed - trace dump get stored, with a full protocol dump that includes all received - and transmitted data. This could be a very effective tool for debugging what - goes wrong. This dump includes every byte the way it is sent to/received - from the server. The dump is the plain-text version, so SSL transfers will - still be readable. - -- I found out that the DEBUGFUNCTION was not called properly everywhere as we - wanted it to. I fixed it. - -- -D now stores all headers to the same file if multiple URLs are given on the - command line! Kevin Roth made me aware of that it didn't already do this! - -- Gustaf Hui wrote an excellent formpost example that used the multi - interface. Unfortunately, it didn't work due to several bugs in how - transfers were made when the multi interface was used. - -Daniel (2 May 2002) -- Hanno Kranzhoff found out that when doing multiple transfers on the same - easy handle, the progress meter would show a bad "currently downloaded - value" when the transfer starts. - -Daniel (1 May 2002) -- Applied another patch by Jacky Lam to make the name resolve info realloc() - stuff work properly. - -Daniel (28 April 2002) -- curl_multi_info_read() is now implemented! - -Daniel (27 April 2002) -- Updated BUGS, TODO, FAQ, INSTALL and added BINDINGS. - -- I think I fixed the DNS cache prune crach Jacky Lam found and reported. - -- I cleaned up the name prefix stuff in the hash and llist modules. - -- FTP responses should now be better on timing out properly. The timeout value - is maximum timeout for the entire request operation, but before this, the - timeout was used as a maximum allowed time between two reads... - -Daniel (26 April 2002) -- Fixed the test suite http server to not use snprintf() anymore due to better - portability. - -Daniel (25 April 2002) -- With Sterling Hughes' new DNS pruning, Jacky Lam asked if this wouldn't - cause problems since the pruning is only checking the entry time, and it - sure could cause problems. Therefor, I've now added and changed code so that - this should not be a problem. Nowhere in the code will be store name - resolved information around so that a sunsequent DNS cache prune should - cause a problem. This of course called for some mild internal changes. - -Daniel (23 April 2002) -- Improved the 'no_proxy' check, as using port numbers in the URL confused it - previously. Reported by Erwan Legrand in bug report #547484. - -- The --interface option now works even on IPv6 enabled builds. Reported by - 'thor'. - -Daniel (22 April 2002) -- The #defines names starting with TIMECOND now has CURL_ prefixes. (The old - names are still #defined too.) Pointed out by Robert Olson. - -- Jacky Lam brought code that lets the name resolve function only use as much - memory as it actually needs. This only works on certain operating systems, - but is totally transparant to all users. - -Daniel (19 April 2002) -- Bjorn Reese fixed pack_hostent to work properly with 64 bit pointers. - -Daniel (18 April 2002) -- Sterling Hughes added code to prune old DNS cache entries, since Jacky Lam - experienced very big caches. - -Daniel (17 April 2002) -- Dirk Manske patched the 301 response to work against the RFC but more like - common browsers do. If a POST get a 301 back, it'll switch to GET in the - next request (if location-following is enabled). - -Daniel (16 April 2002) -- Dirk Manske posted a patch originally written by Ingo Wilken that introduced - two new CURLINFO_* values: CURLINFO_REDIRECT_TIME and - CURLINFO_REDIRECT_COUNT. - -Daniel (15 April 2002) -- Jonatan Lander patched the verbose text 'Disables POST, goes with GET' to - reflect reality better, like when the first request isn't POST and when - the second isn't GET... :-) - -- Craig Davison pointed out that when curl_formadd()ing a file that doesn't - exist, libcurl doesn't return error. Now, curl_easy_perform() will return - CURLE_READ_ERROR if that is the case. Test 41 was added to verify this. - -Version 7.9.6 - -Daniel (14 April 2002) -- Dirk Manske brought a fix that makes libcurl strip off white spaces from the - beginning of cookie contents. - -- Had to patch include/curl/curl.h since MSVC doesn't set the __STDC__ define. - Moonesamy pointed out the problem, Bjorn Reese the solution. - -Version 7.9.6-pre5 - -Daniel (12 April 2002) -- Fixed the TIMER_CONNECT to be more accurate for FTP transfers. Previously - FTP transfers got the "connect done" time set after the initial FTP commands - and not directly after the TCP/IP connect as it should. - - I also made the time stamp get set even if the connect itself fails, which - it didn't do previously. - -- Jean-Philippe Barrette-LaPierre provided his patch that introduces - CURLOPT_DEBUGFUNCTION and CURLOPT_DEBUGDATA. They allow a program to a set a - callback to receive debug/information data. That includes headers and data - that is received and sent. CURLOPT_VERBOSE still controls it. - - By default, there is an internal debugfunction that will make things look - and work as before if not changed. - -Daniel (10 April 2002) -- Sebastien Willemijns found out that -x didn't use the default port number as - is documented. It does now. - -- libcurl-errors.3 is a new man page attempting to document all libcurl error - codes - -- Added two new error codes and changed the behaviour of two old ones - slightly: - - CURLE_WRITE_ERROR - This error was returned *both* for errors that occured when writing - received data to a local file, as well as when we get problems writing data - to a remote server. CURLE_SEND_ERROR has now been added for the latter - error. - - CURLE_READ_ERROR - This error was similarly returned *both* for errors when reading a local - file, as well as when getting problems when reading network data. - CURLE_RECV_ERROR has now been added for the latter error. - - (Two test cases were adjusted accordingly.) - -Daniel (9 April 2002) -- runtests.pl now sets the HOME variable before running curl, to prevent any - actual ~/.curlrc file to fool the tests! - -Version 7.9.6-pre4 - -Daniel (8 April 2002) -- Michael Curtis provided new functionality for curl on some platforms. Using - the --environment option, curl will *set* a bunch of environment variables - to values. The names are the same ones as for the -w/--writeout option. - - For now, this only works on the RISC OS version, as this feature relies on - both OS support and that it matches OS paradigms. - -- Jacky Lam provided a fix for getting headers-only when the reply is HTTP/1.0 - and 304, I edited it slightly. - -Daniel (5 April 2002) -- As requested by Jay Graves, the '.curlrc' file (or _curlrc as it is called - when used in windows), is now loaded from the current directory if the HOME - environment variable isn't set (or if it is too long). I also enlarged the - array used to store the full file path in, to 512 bytes. - -- Kevin Roth pointed out to me why the "19 March" change regarding -G and -I - was stupid and the change was reverted. Added test case 48 to verify the - functionality. - -Version 7.9.6-pre3 - -Daniel (4 April 2002) -- Jonatan Lander brought a patch that makes curl/curl.h compile nicely on - pre-ISO compilers, like when using gcc -traditional. - -Daniel (3 April 2002) -- Jacky Lam identified a glitch when getting headers-only, where libcurl would - "hang" 1 second in vain in the select() loop before returning back. - -- Tor Arntsen brought a patch for multipart formposts. It turned out that the - "CGI_Lite Perl package" makes some bad assumptions on what letters that may - be used in boundary strings and thus curl could confuse it by including '+' - and '/'. While this is standards-compliant, we change the behavior to work - smoothly with existing software based on that package. - -Daniel (2 April 2002) -- Gerhard Herre filed bug report #536238 where he pointed out a crash in - verbose FTP passive transfers for AIX. - -- Clarence Gardner pointed out a minor flaw in how libcurl didn't properly - take care of all errors that SSL_read() could return. - -- Jacky Lam fixed a MALLOCDEBUG problem in lib/getinfo.c - -Daniel (27 March 2002) -- T. Bharath pointed out a flaw in the connection re-use function that didn't - check proxy connections properly for "deadness" before they were re-used. - -- Pedro Neves found out that HTTP POSTing with --data-binary did not properly - work under Windows as the file specified wasn't read fully binary! - -Daniel (25 March 2002) -- Jacky Lam brought a fix that improves treatment of cookies using identical - domains but with leading dots properly. - -Daniel (22 March 2002) -- Miklos Nemeth updated the windows section of the docs/INSTALL file and the - windows makefiles. - -- Jon Dillon provided us with several good-looking curl images for - promotion. View them here https://curl.haxx.se/icons.html - -Daniel (20 March 2002) -- Peter Verhas found out that CRLF replacement in uploads was not working. I - fixed it, and added test case 128 that verifies the functionality. - -- The list formerly known as curl-main is now named curl-users and is hosted - by sourceforge. Susbcribe to the new list, get off the old one. - -Version 7.9.6-pre2 - -Daniel (19 March 2002) -- Made -G and -I on the same command line cause an error. - -- Moved the multi.h file to the "public" include directory and made it get - included by curl.h so that no extra include files will be necessary to use - it. - - Added docs and man pages for the multi interface to the release archive. - Added the three example source codes too. - - Necessary steps in my campaign to sneak in the multi interface... ;-) - -- Updated the year in all copyright notices in all C and H files. - -Daniel (18 March 2002) -- Tomas Szepe found out that -d and -G didn't mix as they should. I broke this - in 7.9.5... Added test case 32 for this. - -Version 7.9.6-pre1 - -Daniel (16 March 2002) -- Peter Verhas pointed out that the curl_escape and curl_unscape man pages - contained factual errors. - -- Albert Choy found and corrected a problem with the verbose output when doing - PASV ftp transfers. It could make libcurl crash. - - Details in bug report #530562: - https://sourceforge.net/p/curl/bugs/178/ - -Daniel (15 March 2002) -- Jun-ichiro itojun Hagino filed bug report #530204 that clearly pointed out - the PF_INET fix from February 19 as a not-very-good fix as it broke IPv6 - capability! That patch is now reverted. - - The problem with slow name lookups with getaddrinfo() on non-IPv6 enabled - hosts are instead made by first checking if the stack is IPv6-enabled and if - not, the PF_INET is used and otherwise we go with the full PF_UNSPEC. - -- T. Bharath pointed out that when we return an "error" from a WRITEFUNCTION - as described in the man page, libcurl did not return the documented error - code (CURLE_WRITE_ERROR) but would instead return CURLE_READ_ERROR. This is - now corrected. - -Daniel (14 March 2002) -- Setting CURLOPT_POST without setting CURLOPT_POSTFIELDS now read the POST- - data from the callback. - -- The GOPHER support seems to be broken. I don't think I'll even start fixing - it until someone else finds out... :-) - -Daniel (13 March 2002) -- Trying 'curl -I ftp.sunet.se' or similar did a SIZE on a silly "(nil)" - string. If such a file would be present, curl returned the size of it! Now - we prevent this. - -- Curl_sendf() was fixed to deal with situation where Curl_write() would've - blocked and thus return -1. - -- Setting CURLOPT_PROGRESSFUNCTION to NULL now restores the internal function. - -- All CURLFORM_* options can now be used in a CURLFORM_ARRAY except the - CURLFORM_ARRAY itself. This was necessary since we couldn't expand the - CURLFORM_* list proprely and unrestricted until this was the case. It was - also a bit peculiar to users why some options could be used in an array - while others couldn't. - -- Removed some silly CRLF lines that had accidentally slipped into src/main.c - Nico Baggus pointed them out to me. - -Daniel (11 March 2002) -- CURLFORM_FILENAME was added. This can be set when creating a file upload - part, to set the 'filename' field to a custom value. If this isn't used, - the actually used filename will be included instead (as libcurl always has - done). curl was adjusted accordingly, and now -F accepts a 'filename=' field - too, and allows constructs such as: - - -F 'name=@filename;filename=/dev/null' - - and this can be combined with type= too, in a manner similar to: - - -F "file=@log/test39.txt;filename=fakerfile;type=moo/foobar" - - Test case 39 was added to verify this functionality. - -- The struct formerly known as HttpPost is now named curl_httppost to properly - use the curl name space. I added a #define for the old name to make existing - programs compile even when this new include file is used. - -Daniel (8 March 2002) -- Clifford also discovered that if the client code failed early, as when doing - "curl -O" only, it would do fclose(NULL) which caused a segmentation fault - on some systems. - -- Clifford Wolf provided a patch that made --progress-bar work again. - -- I closed bug report #527032 by making sure that we add a newline after a - transfer when --progress-bar has been used. Before, without the newline, it - made the subsequent text come out wrong. - -Version 7.9.5 - -Daniel (7 March 2002) -- Added docs/KNOWN_BUGS to the release archive. - -Daniel (6 March 2002) -- Kevin Roth corrected a flaw in the curl client globbing code that made it - mess up backslashes. This was most notable on windows (cygwin) machines when - using file://. - -- Brad provided another fix for building outside the source-tree. - -- Ralph Mitchell patched away a few compiler warnings in tests/server/sws.c - -Daniel (5 March 2002) -- I noticed that the typedef in curl.h for the progress callback prototype was - wrong and thus applications that used it would not get the proper input - data. It used size_t where the implementation actually uses doubles! - - I wish I could blame someone else, but this was my fault. Again. - -Version 7.9.5-pre6 - -Daniel (4 March 2002) -- Cut off the changes done during 2001 from this changelog file and put them - in a separate file (CHANGES.2001), available from CVS of course. - -- I removed the multi directory. The example sources were moved to the - docs/examples directory where they belong. - -- Wrote 7 new man pages for the current functions in the new multi interface. - They're all still pretty basic, but we can use them as a start and add more - contents to them when we figure out what to write. The large amount of man - pages for libcurl now present made me decide to put them in a new separate - subdirectory in the docs directory. Named libcurl. - -- Giuseppe Corbelli provided a template file for the EPM package manager, it - gets generated nicely by the configure script now. - -Version 7.9.5-pre5 - -Daniel (1 March 2002) -- Moved the memanalyze.pl script into the tests/ dir and added it to the - release archives. It was previously only present in the CVS tree. - -- Modified the February 17th Host: fix, as bug report #523718 pointed out that - it caused crashes! - -- Nico Baggus added more error codes to the VMS stuff. - -- Wesley Laxton brought the code that introduced the new CURLOPT_PREQUOTE - option. It is just another FTP quote option that allows the user to specify - a list of FTP commands to issue *just before* the transfer command (RETR or - STOR etc). It has turned up a few systems that really need this. - - The curl command line tool can also take advantage of this by prefixing the - quote commands with a plus (+) in similar style that post transfer quote - commands are specified. - - This is not yet documented. There is no test case for this yet. - -Daniel (28 February 2002) -- Ralph Mitchell made some serious efforts and put a lot of sweat in setting - up scripts and things for me to be able to repeat his problems, and I - finally could. I found a problem with the header byte counter that wasn't - increased properly and thus we could return CURLE_GOT_NOTHING when we in - fact had received data. - -Daniel (27 February 2002) -- I had to revert the non-space parsing cookie fix I posted to the mailing - list. Expire dates do have spaces and still need to get parsed properly! - Instead we just ignore trailing white space and it seems to work... - -Daniel (26 February 2002) -- Made the cookie property 'Max-Age' work, just since we already tried to - support it, it is better to do it right. No one uses this anyway. - -- The cookie parser could crash if a really weird (illegal) cookie line was - received. I also made it better discard really oddly formatted lines better. - - Made the cookie jar store the second field from the left using the syntax - that Netscape and Mozilla probably like. Curl itself ignores it. - - Added test case 31 for these cases. - - Clay Loveless' email regarding some cookie issues started my cleanup. - -- Kevin Roth pointed out that my automake fiddles broke the ability to build - outside the source-tree and I posted a patch to the mailing list that brings - this ability back. - -Version 7.9.5-pre4 - -Daniel (25 February 2002) -- Fiddled with the automake files to make all source files in the lib - directory not have ../src in the include path, and the src sources shouldn't - have ../lib! - -- All 79 test cases ran OK under Linux and Solaris using the new HTTP server - in the test suite. The new HTTP server was first donated by Georg Horn and - subsequently modified to work with the test suite. It is currently still not - portable enough to run on "all over" but this is a start and I can run all - curl tests on my machines. This is an important requirement for the upcoming - public release. - -- Using -d and -I on the same command line now reports an error, as it implies - two different HTTP requests that can't be mixed. - -- Jeffrey Pohlmeyer provided a patch that made the -w/--write-out option - support %{content_type} to get the content type of the recent download. - -- Kevin Roth reported that pre2 and pre3 didn't compile properly on cygwin, - and this was because I used #ifdef HAVE_WINSOCK_H in lib/multi.h to figure - out if we could include winsock.h which turns out not to be a wise choice to - do on cygwin since it has the file but can't include it! - -Daniel (22 February 2002) -- Added src/config-vms.h to the release archive. - -- Fixed the connection timeout value again, the change from February 18 wasn't - complete. - -Version 7.9.5-pre3 - -Daniel (21 February 2002) -- Kevin Roth and Andrés García both found out that lib/config.h.in was missing - in the pre-release archive and thus the configure script failed. - -Version 7.9.5-pre2 - -Daniel (20 February 2002) -- Andrés García provided a solution to bug report #515228. the total time - counter was not set correctly when -I was used during some conditions (all - headers were read in one single read). - -- Nico Baggus provided a huge patch with minor tweaks all over to make curl - compile nicely on VMS. - -Daniel (19 February 2002) -- Rick Richardson found out that by replacing PF_UNSPEC with PF_INET in the - getaddrinfo() calls, he could speed up some name resolving calls with an - order of magnitudes on his Redhat Linux 7.2. - -- Philip Gladstone found a second INADDR_NONE problem where we used long - intead of in_addr_t which caused 64bit problemos. We really shouldn't define - that on two different places. - -Daniel (18 February 2002) -- Philip Gladstone found a problem in how HTTP requests were sent if the - request couldn't be sent all at once. - -- Emil found and corrected a bad connection timeout comparison that made curl - use the longest of connect-timeout and timout as a timeout value, instead of - the shortest as it was supposed to! - -- Aron Roberts provided updated information about LDAP URL syntax to go into - the manual as a replacement for the old references. - -Daniel (17 February 2002) -- Philip Gladstone pointed out two missing include files that made curl core - dump on 64bit architectures. We need to pay more attention on these details. - It is *lethal* to for example forget the malloc() prototype, as 'int' is - 32bit and malloc() must return a 64bit pointer on these platforms. - -- Giaslas Georgios fixed a problem with Host: headers on repeated requests on - the same handle using a proxy. - -Daniel (8 February 2002) -- Hanno L. Kranzhoff accurately found out that disabling the Expect: header - when doing multipart formposts didn't work very well. It disabled other - parts of the request header too, resulting in a broken header. When I fixed - this, I also noticed that the Content-Type wasn't possible to disable. It is - now, even though it probably is really stupid to try to do this (because of - the boundary string that is included in the internally generated header, - used as form part separator.) - -Daniel (7 February 2002) -- I moved the config*.h files from the root directory to the lib/ directory. - -- I've added the new test suite HTTP server to the CVS repository, It seems to - work pretty good now, but we must make it get used by the test scripts - properly and then we need to make sure that it compiles, builds and runs on - most operating systems. - -Version 7.9.5-pre1 - -Daniel (6 February 2002) -- Miklos Nemeth provided updated windows makefiles and INSTALL docs. - -- Mr Larry Fahnoe found a problem with formposts and I managed to track down - and patch this bug. This was actually two bugs, as the posted size was also - said to be two bytes too large. - -- Brent Beardsley found out and brought a correction for the - CURLINFO_CONTENT_TYPE parser that was off one byte. This was my fault, I - accidentaly broke Giaslas Georgios' patch. - -Daniel (5 February 2002) -- Kevin Roth found yet another SSL download problem. - -Version 7.9.4 - -- no changes since pre-release - -Version 7.9.4-pre2 - -Daniel (3 February 2002) -- Eric Melville provided a few spelling corrections in the curl man page. - -Daniel (1 February 2002) -- Andreas Damm corrected the unconditional use of gmtime() in getdate, it now - uses gmtime_r() on all hosts that have it. - -Daniel (31 January 2002) -- An anonymous bug report identified a problem in the DNS caching which made it - sometimes allocate one byte too little to store the cache entry in. This - happened when the port number started with 1! - -- Albert Chin provided a patch that improves the gethostbyname_r() configure - check on HP-UX 11.00. - -Version 7.9.4-pre1 - -Daniel (30 January 2002) -- Georg Horn found another way the SSL reading failed due to the non-blocking - state of the sockets! I fixed. - -Daniel (29 January 2002) -- Multipart formposts now send the full request properly, including the CRLF. - They were previously treated as part of the post data. - -- The upload byte counter bugged. - -- T. Bharath pointed out that we seed SSL on every connect, which is a time- - consuming operation that should only be needed to do once. We patched - libcurl to now only seed on the first connect when unseeded. The seeded - status is global so it'll now only happen once during a program's life time. - - If the random_file or egdsocket is set, the seed will be re-made though. - -- Giaslas Georgios introduced CURLINFO_CONTENT_TYPE that lets - curl_easy_getinfo() read the content-type from the previous request. - -Daniel (28 January 2002) -- Kjetil Jacobsen found a way to crash curl and after much debugging, it - turned out it was a IPv4-linux only problem introduced in 7.9.3 related to - name resolving. - -- Andreas Damm posted a huge patch that made the curl_getdate() function fully - reentrant! - -- Steve Marx pointed out that you couldn't mix CURLOPT_CUSTOMREQUEST with - CURLOPT_POSTFIELDS. You can now! - -Daniel (25 January 2002) -- Krishnendu Majumdar pointed out that the header length counter was not reset - between multiple requests on the same handle. - -- Pedro Neves rightfully questioned why curl always append \r\n to the data - that is sent in HTTP POST requests. Unfortunately, this broke the test suite - as the test HTTP server is lame enough not to deal with this... :-O - -- Following Location: headers when the connection didn't close didn't work as - libcurl didn't properly stop reading. This problem was added in 7.9.3 due to - the restructured internals. 'Frank' posted a bug report about this. - -Daniel (24 January 2002) -- Kevin Roth very quickly spotted that we wrongly installed the example - programs that were built in the multi directory, when 'make install' was - used. :-/ - -Version 7.9.3 - -Daniel (23 January 2002) -- Andrés García found a persistancy problem when doing HTTP HEAD, that made - curl "hang" until the connection was closed by the server. This problem has - been introduced in 7.9.3 due to internal rewrites, this was not present in - 7.9.2. - -Version 7.9.3-pre4 - -Daniel (19 January 2002) -- Antonio filed bug report #505514 and provided a fix! When doing multipart - formposts, libcurl would include an error text in the actual post if a - specified file wasn't found. This is not libcurl's job. Instead we add an - empty part. - -Daniel (18 January 2002) -- Played around with stricter compiler warnings for gcc (when ./configure - --enable-debug is used) and changed some minor things to stop the warnings. - -- Commented out the 'long long' and 'long double' checks in configure.in, as - we don't currently use them anyway and the code in lib/mprintf.c that use - them causes warnings. - -- Saul Good and jonatan pointed out Mac OS X build problems with pre3 and how - to correct them. Two compiler warnings were removed as well. - -- Andrés García fixed two minor mingw32 building problems. - -Version 7.9.3-pre3 - -Daniel (17 January 2002) -- docs/libcurl-the-guide is a new tutorial for our libcurl programming - friends. - -- Richard Archer brought back the ability to compile and build with OpenSSL - versions before 0.9.5. - [https://sourceforge.net/p/curl/bugs/149/] - -- The DNS cache code didn't take the port number into account, which made it - work rather bad on IPv6-enabled hosts (especially when doing passive - FTP). Sterling fixed it. - -Daniel (16 January 2002) -- Georg Horn could make a transfer time-out without error text. I found it and - corrected it. - -- SSL writes didn't work, they return an uninitialized value that caused - havoc all over. Georg Horn experienced this. - -- Kevin Roth patched the curl_version() function to use the proper OpenSSL - function for version information. This way, curl will report the version of - the SSL library actually running right now, not the one that had its headers - installed when libcurl was built. Mainly intersting when running with shared - OpenSSL libraries. - -Version 7.9.3-pre2 - -Daniel (16 January 2002) -- Mofied the main transfer loop and related stuff to deal with non-blocking - sockets in the upload section. While doing this, I've now separated the - connection oriented buffers to have one for downloads and one for uploads - (as two can happen simultaneously). I also shrunk the buffers to 20K - each. As we have a scratch buffer twice the size of the upload buffer, we - arrived at 80K for buffers compared with the previous 150K. - -- Added the --cc option to curl-config command as it enables so very cool - one-liners. Have a go a this one, building the simple.c example: - - $ `curl-config --cc --cflags --libs` -o example simple.c - -Daniel (14 January 2002) -- I made all socket reads (recv) handle EWOULDBLOCK. I hope nicely. Now we - only need to address all writes (send) too and then I'm ready for another - pre-release... - -- Stoned Elipot patched the in_addr_t configure test to make it work better on - more platforms. - -Daniel (9 January 2002) -- Cris Bailiff found out that filling up curl's SSL session cache caused a - crash! - -- Posted the curl questionnaire on the web site. If you haven't posted your - opinions there yet, go there and do it now while it is still there: - - https://curl.haxx.se/q/ - -- Georg Horn quickly found out that the SSL reading no longer worked as - supposed since the switch to non-blocking sockets. I've made a quick patch - (for reading only) but we should improve it even further. - -Version 7.9.3-pre1 - -Daniel (7 January 2002) -- I made the 'bool' typedef use an "unsigned char". It makes it the same on - all platforms, no matter what the platform thinks the default format for - char is. This was noticed since we made a silly comparison involving such a - bool variable, and only one compiler/platform combination (on Debian Linux) - complained about it (that happened to have its char unsigned by default). - -- Bug report #495290 identified a cookie parsing problem that was corrected. - When a Set-Cookie: line is received without a trailing semicolon, libcurl - didn't read the last "name=value" pair of the line, leading to confusions... - -- Sterling committed his updated DNS cache code. - -- I worked with Georg Horn and comments from Götz Babin-Ebell and switched - curl's socket operations completely over to non-blocking for the entire - operation (previously we used non-blocking only for the connection phase). - We had to do this to make the SSL connection phase timeout properly without - the use of signals. A little extra code to deal with this was added. - -- T. Bharath pointed out a slightly obscure cookie engine flaw. - -- Pete Su pointed out that libcurl didn't treat HTTP code 204 as it should. - 204-replies never provides a response-body. This resulted in bad persistant - behavior when 204 was received. - -Daniel (5 January 2002) -- SM updated the VC++ library Makefiles for the new source files. - -Daniel (4 January 2002) -- I discovered that we wrongly used inet_ntoa() (instead of inet_ntoa_r() in - two places in the source code). One happened with VERBOSE set on connects, - and the other when VERBOSE was on and krb4 over nat was used... I honestly - don't think anyone has suffered from these mistakes. - -- I replaced a lot of silly occurances of printf() to instead use the more - appropriate Curl_infof() or Curl_failf(). The krb4 and telnet code were - affected. - -- Philip Gladstone found a few more problems with 64-bit archs (the 64-bit - sparc on solaris 8). - -- After discussions on the libcurl list with Raoul Cridlig, I just made FTP - response lines get passed to the header callback if such a one is - registered. It'll make it possible for any application to get all the - responses an FTP server sends to libcurl. - -Daniel (3 January 2002) -- Sterling Hughes brought a few buckets of code. Now, libcurl will - automatically cache DNS lookups and re-use the previous results first if any - such is available. It greatly improves speed when doing many repeated - operations to the same host. - -- As the test case uses --include and then --head, I had to modify src/main.c - to deal with this situation slightly better than previously. When done, we - have 100% good tests again in the main branch. - -Daniel (2 January 2002) -- Made test case 25 run again in the multi-dev branch. But it seems that the - changes done on dec-20 made test case 104 cease to work (in both branches). - -- Philip Gladstone pointed out a few portability problems in the source code - that didn't compile on 64-bit sparcs using Sun's native compiler. -Daniel (20 December 2001) -- Björn Stenberg caught an unpleasent (but hard-to-find) bug that could cause - libcurl to hang on transfers over proxy, when the proxy was specified with - an environment variable! - -- Added code to make ftp operations treat the NO_BODY and HEADERS options - better: - - NO_BODY set TRUE and HEADERS set TRUE: - Return a set of headers with file info - - NO_BODY set FALSE - Transfer data as usual, HEADERS is ignored - - NO_BODY set TRUE and HEADERS set FALSE - Don't transfer any data, don't return any headers. Just perform the set - of FTP commands. - -Daniel (17 December 2001) -- Götz Babin-Ebell dove into the dark dungeons of the OpenSSL ENGINE stuff and - made libcurl support it! This allows libcurl to do SSL connections with the - private key stored in external hardware. - - To make this good, he had to add a bunch of new library options that'll be - useful to others as well: - - CURLOPT_SSLCERTTYPE set SSL cert type (PEM/DER) - CURLOPT_SSLKEY set SSL private key (file) - CURLOPT_SSLKEYTYPE: set SSL key type (PEM/DER/ENG) - CURLOPT_SSLKEYPASSWD: set the passphrase for your private key - (CURLOPT_SSLCERTPASSWD is an alias) - CURLOPT_SSLENGINE: set the name of the crypto engine - (returns CURLE_SSL_ENGINE_NOTFOUND on error) - CURLOPT_SSLENGINE_DEFAULT: set the default engine - - There are two new failure codes: - - CURLE_SSL_ENGINE_NOTFOUND - CURLE_SSL_ENGINE_SETFAILED - -Daniel (14 December 2001) -- We have "branched" the source-tree at a few places. Checkout the CVS sources - with the 'multi-dev' label to get the latest multi interface development - tree. The idea is to only branch affected files and to restrict the branch - to the v8 multi interface development only. - - *NOTE* that if we get bug reports and patches etc, we might need to apply - them in both branches! - - The multi-dev branch is what we are gonna use as main branch in the future - if it turns out successful. Thus, we must maintain both now in case we need - them. The current main branch will be used if we want to release a 7.9.3 or - perhaps a 7.10 release before version 8. Which is very likely. - -- Marcus Webster provided code for the new CURLFORM_CONTENTHEADER option for - curl_formadd(), that lets an application add a set of headers for that - particular part in a multipart/form-post. He also provided a section to the - man page that describes the new option. - -Daniel (11 December 2001) -- Ben Greear made me aware of the fact that the Curl_failf() usage internally - was a bit sloppy with adding newlines or not to the error messages. Let's - once and for all say that they do not belong there! - -- When uploading files with -T to give a local file name, and you end the URL - with a slash to have the local file name used remote too, we now no longer - use the local directory as well. Only the file part of the -T file name - will be appended to the right of the slash in the URL. - -Daniel (7 December 2001) -- Michal Bonino pointed out that Digital Unix doesn't have gmtime_r so the - link failed. Added a configure check and corrected source code. - -Version 7.9.2 - -Daniel (5 December 2001) -- Jon Travis found out that if you used libcurl and CURLOPT_UPLOAD and then - on the same handle used CURLOPT_HTTPGET it would still attempt to upload. - His suggested fix was perfect. - -Daniel (4 December 2001) -- Incorporated more macos fixes and added four specific files in a new - subdirectory below src. - -Daniel (3 December 2001) -- Eric Lavigne reported two problems: - - First one in the curl_strnequal() function. I think this problem is rather - macos 9 specific, as most platform provides a function to use instead of the - one provided by libcurl. - - A second, more important, was in the way we take care of FTP responses. The - code would read a large chunk of data and search for the end-of-response - line within that chunk. When found, it would just skip the rest of the - data. However, when the network connections are special, or perhaps the - server is, we could actually get more than one response in that chunk of - data so that when the next invoke to this function was done, the response - had already been read and thrown away. Now, we cache the data not used in - one call, as it could be useful in the subsequent call. Test case 126 was - added and the test ftp server modified, to exercise this particular case. - -Version 7.9.2-pre8 - -Daniel (2 December 2001) -- Bug report #487825 correctly identified a problem when using a proxy and - following a redirection from HTTP to HTTPS. libcurl then re-used the same - proxy connection but without doing a proper HTTPS request. - -- Fixed win32 compiling quirks. - -Version 7.9.2-pre7 - -Daniel (30 November 2001) -- Documented --disable-epsv and CURLOPT_FTP_USE_EPSV. - -Daniel (29 November 2001) -- Added --disable-epsv as an option. When used, curl won't attempt to use the - EPSV command when doing passive FTP downloads. Wrote a test case for it. - -- Eric provided a few more fixes for building on Macs. He also pointed out - a flaw in the signal handler restoration code. - -Daniel (28 November 2001) -- Fiddled with some Tru64 problems reported by Dimitris Sarris. They appeared - only when using VERBOSE ftp transfers. Do we use a too small buffer for - gethostbyaddr_r(), was the lack of using in_addr_t wrong or is it that the - hostent struct must be blanked before use? With Dimitris help and these - patches, the problems seem to be history. - -- CURLOPT_FTP_USE_EPSV was added and can be set to FALSE to prevent libcurl - from using the EPSV command before trying the normal PASV. Heikki Korpela - pointed out that some firewalls and similar don't like the EPSV so we must - be able to shut if off to work everywhere. - -- I added a configure check for 'in_addr_t' and made the ftp code use that to - receive the inet_addr() return code in. Works on Solaris and Linux at - least. The Linux man page for inet_addr() doesn't even mention in_addr_t... - -- Adjusted (almost) all FTP tests to the new command sequence. - -- FTP command sequence changes: - - EPSV is now always attempted before PASV. It is the final touch to make IPv6 - passive FTP downloads to work, but EPSV is not restricted to IPv6 but works - fine with IPv4 too on the servers that support it. - - SIZE is now always issued before RETR. It makes curl know the actual - download size before the download takes place, as it makes it less important - to find the size sent in RETR responses. Many sites don't include the size - in there. - - Both these changes made it necessary to change the test suite's ftp server - code, and all FTP test cases need to be checked and adjusted! - -Daniel (27 November 2001) -- Hans Steegers pointed out that the telnet code read from stdout, not stdin - as it is supposed to do! - -Version 7.9.2-pre6 - -Daniel (27 November 2001) -- Eric Lavigne's minor changes to build on MacOS before OS X were applied. - -- greep at mindspring.com provided a main index.html page for our release - archive docs directory. It just links to all the existing HTML files, but - I think it may come useful to people. - -- There's now some initial code to support the EPSV FTP command. That should - be used to do passive transfers IPv6-style. The code is still #if 0'ed in - lib/ftp.c as I have no IPv6 ftp server to test this with. - -Daniel (26 November 2001) -- Robert Schlabbach had problems to understand how to do resumed transfers, - and I clarified the man page -C section somewhat. - -Version 7.9.2-pre5 - -Daniel (22 November 2001) -- Andrés García helped me out to track down the roots of bug report #479537, - which was concerning curl returning the wrong error code when failing to - connect. This didn't happen on all systems, and more specificly I've so far - only seen this happen on IPv4-only Linux hosts. - -- I applied the fixes for the two bugs Eric Lavigne found when doing his MacOS - port. A missing comma in arpa_telnet.h and a pretty wild write in the FTP - response reader function. The latter write is however likely to occur in our - own buffer unless very big FTP server replies (>25K) are read. I've never - seen such a reply ever, so I think this is a relatively minor risk. - -Daniel (21 November 2001) -- Moonesamy provided code to prevent junk from being output when libcurl - returns an error code but no error description and that corrects how make is - run in the Makefile.dist file (that appears as root Makefile in release - archives). - -- Eric Lavigne mailed me bugfixes and patches for building libcurl on MacOS - (non-X). - -- Kevin Roth modified the cygwin files once again, now to build against the - shared OpenSSL DLLs. - -Version 7.9.2-pre4 - -Daniel (20 November 2001) -- Georg Horn brought a patch that introduced CURLINFO_STARTTRANSFER_TIME, - complete with man page updates! - -Daniel (19 November 2001) -- Miklos Nemeth provided details enough to update the Borland makefile - properly. - -- Lars M Gustafsson found a case with a bad free(). In fact, it was so bad I'm - amazed we never saw this before! - -- Kevin Roth patched the cygwin Makfile. - -Daniel (16 November 2001) -- Klevtsov Vadim fixed a bug in how time-conditionals were sent when doing - HTTP. - -Version 7.9.2-pre3 - -Daniel (14 November 2001) -- Samuel Listopad patched away the problem with SSL we got when someone call - curl_global_init() => curl_global_cleanup() => curl_global_init(). The - second init would not "take" and SSL would be unusable with curl from that - point. This doesn't change the fact that calling the functions that way is - wrong. curl_global_init() should be called exactly once and not more. - -Daniel (13 November 2001) -- Fixed some minor variable type mixups in ftp.c that caused compiler warnings - on HP-UX 11.00. - -- The FTP fix I did yesterday used an uninitialized variable that caused - spurious errors when doing FTP. - -Version 7.9.2-pre2 - -Daniel (12 November 2001) -- Ricardo Cadime fell over a multiple-requests problem when first a FTP - directory fetch failed and then a second request is made after that. The - second request happened to get the FTP server response back from the - previous request, when it did its initial CWD command. - -- Bjorn Reese pointed out that we could improve the time diff function to - prevent truncation a bit. - -- Kai-Uwe Rommel made me aware that -p (http proxy tunnel) silly enough didn't - work for plain HTTP requests! So I made that work. - -Version 7.9.2-pre1 - -Daniel (12 November 2001) -- Rewrote the Curl_ConnectHTTPProxyTunnel(). It should now not only work a lot - faster, it should also support such ("broken") proxies that John Lask - previously have reported problems with. His proxy sends a trailing zero byte - after the end of the (proxy-) headers. I've tested this myself and it seems - to work on a proxy the previous version also worked with...! This rewrite is - due to the problems John Lask previously experienced. - -- Andrés García found out why the "current speed" meter sometimes showed 2048K - for very quick transfers. It turned out the "time diff"-function returned a - zero millisecond diff. We now always say it is at least one millisecond! In - reality, these timers very rarely have that good resolution so even though - the time diff was longer than 1 millisecond, it was reported as no diff. - -- I also modified the getinfo() again when returning times, as Paul Harrington - reports that 7.9.1 only returns times with 1 second accuracy, which indeed - is wrong. - -Daniel (8 November 2001) -- Marcus Webster found out that curl_formadd() could read one byte outside a - buffer boundary, which then of course could lead to a crash. Marcus also - gracefully provided a patch for this this. - -- Glen Scott ran configure on his Cobalt Qube and it didn't figure out the - correct way of calling gethostbyname_r() and thus failed to resolve hosts. - This is two errors: it shouldn't continue the configure script if it finds - gethostbyname_r() but can't figure out how to use it, and it should really - figure out how to use it as it was running Linux and we know how that - works... - -Daniel (7 November 2001) -- docs/VERSIONS is a new file in the archive that explains the version number - system we use in the curl project. - -- Did some more fixes that now makes libcurl only ignore signals as long as - it needs to, and then restore (if any) previous signal handler again. - -Daniel (6 November 2001) -- Enrik Berkhan posted bug report #478780, in which he very correctly pointed - out two bad timeout matters in libcurl: we didn't restore the sigaction - struct (the alarm handler for SIGALRM) nor did we restore the previous - alarm() timeout that could've been set by a "parent" process or similar. - -- Kevin Roth made the cygwin binary get stripped before install. - -Daniel (5 November 2001) -- Detlef Schmier reported that curl didn't compile using Solaris 8 with the - native cc compiler. It was due to a bad function prototype. Fixed now. - Unfortunately, I can't enable the -Wstrict-prototypes in my debug builds - though, as gcc then complains like crazy on OpenSSL include files... :-( - -- John Lask provided SSL over HTTP proxy fixes. They'll need some tweaking - to work on all platforms. - -- John Lask added the -1/--TLSv1 options that forces SSL into using TLS - version 1 when speaking HTTPS. - -- John Lask brought a brand new VC++ makefile for the lib directory, that - works a lot better than the previous! - -- Ramana Mokkapati brought some clever insights on the LDAP failures (bug - report #475407), and his suggested changes are now applied. - -Version 7.9.1 - -Daniel (4 November 2001) -- I've added a number of new test cases the last few days. A few of them since - I got reports that hinted on problems on timeouts, so I added four tests - with timeouts for all sorts of protocols and stuff. I also came to think of - a few other error scenarios that we currently didn't test properly, so I - wrote up tests for a few of those too. - -Daniel (2 November 2001) -- Replaced read() and write() with recv() and send() for socket operations - even under normal unixes. - -Daniel (1 November 2001) -- When an FTP transfer was aborted due to a timeout, it wasn't really aware of - how many bytes that had been transferred and the error text always said 0 - bytes. I modified this to output the actually transferred amount! :-) - -- The FTP fixes in pre7 didn't compile on IPv6 enabled hosts. Does now. I also - added more comments in the lib/ftp.c source file. - -- Minor updates to the FAQ, added a brand new section to the web site about - the name issue (who owns "curl"? will someone sue us? etc etc): - https://curl.haxx.se/legal/thename.html - -Version 7.9.1-pre7 - -Daniel (31 October 2001) -- The curl_easy_getinfo() timers accidentally lost their subsecond accuracy as - the calculations used longs instead of doubles! Paul Harrington reported. - -- The SSL SocketIsDead() checks weren't good enough (as expected really), so I - had to add a generic internal try-it-out system. If the request on a re-used - connection seems to fail, then we go back and get a new (fresh) connection - and re-tries the request on that instead. It kind of makes the - SocketIsDead() check obsolete, but I think it is a quicker way for those - cases where it actually discovers that the connection is dead. - -- When fixing the above, I noticed that we did quite a few writes to sockets - in libcurl where we didn't check the return code (that it actually worked to - send the data). With the new "attempted request" system we must detect those - situations so I went over a bunch of functions, changed return types and - added checks for what they actually return. - -Version 7.9.1-pre6 - -Daniel (31 October 2001) -- Paul Harrington detected a problem with persistant SSL connections. Or to be - more exact, we didn't properly detect that the connection was dead and then - a second connection would try to re-use it wrongly. The solution to this - problem is still not very clear and I'm working on it. One OpenSSL insider - said there is no way to know if the SSL connection is alive or not without - actually trying an operation. - -Daniel (30 October 2001) -- If a cookie was read from a file, it could accidentally strdup() a NULL - pointer. Paul Harrington reported. [http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/curl/curl/lib/cookie.c.diff?r1=1.25&r2=1.26] - -- The MANUAL file now documents -t correctly. I also fixed the -T description - in the curl.1 man page. - -Daniel (29 October 2001) -- John Janssen found out that curl_formadd was missing in the libcurl.def file - and that the docs stated the wrong return type for the function. - -- Andrés García found a bug with multiple files in the curl_formadd() function, - that I removed with this patch [http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/curl/curl/lib/formdata.c.diff?r1=1.25&r2=1.26]. - -- Kevin Roth brought another patch that moved the cygwin package files to the - packages/Win32/cygwin directory. - -- A bug in the connection re-use logic made repeated requests to the same FTP - server (when using name+pasword in the URL) sometimes use more than one - connection. [http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/curl/curl/lib/url.c.diff?r1=1.166&r2=1.167] - -- Moonesamy tracked down and fixed a problem with the new 7.9.1 connect - code. This corrected the error Kevin Roth reported on the 7.9.1-pre5 release - (test 19)... - [http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/curl/curl/lib/connect.c.diff?r1=1.13&r2=1.14] - -Daniel (26 October 2001) -- Added test28 which verifies that "Location:"-following works even if the - contents is separated with more than one space. - -Daniel (25 October 2001) -- Ramana Mokkapati pointed out that LDAP transfers would 'hang' after the - correct data has been output. - -Version 7.9.1-pre5 - -Daniel (24 October 2001) -- T. Bharath found a memory leak in the cookie engine. When we update a cookie - that we already knew about, we lost a chunk of memory in the progress... The - brand new test case 27 now tests for this occurrence. [http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/curl/curl/lib/cookie.c.diff?r1=1.24&r2=1.25] - -Daniel (23 October 2001) -- pack_hostent() didn't properly align some pointers, so at least SPARC CPUs - would core. [http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/curl/curl/lib/hostip.c.diff?r1=1.34&r2=1.35] - -Daniel (22 October 2001) -- Tom Benoist reported that this SGI IRIX compiler didn't handle indented - preprocessor instructions, so they're no longer in the source code! - -- Applied Kevin Roth's patches to make it easier to build cygwin packages from - the out-of-the-box curl release archives. - -- I forgot to mention it below, but libcurl now closes connections that report - transfer failures. Unconditionally. This could be made more nicely in the - future if we set a flag or something that the connection is still good to be - used for the errors that know that for a fact. We have to close the - connection for the cases where we abort for example a HTTP transfer in the - middle, or otherwise we might re-use that connection later with lots of data - still being sent to us on it. [http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/curl/curl/lib/transfer.c.diff?r1=1.63&r2=1.64] - -Daniel (19 October 2001) -- CURLE_GOT_NOTHING is now returned when a HTTP server doesn't return - anything, not even a header. test case 37 was added to test for this. - -- T. Bharath made curl_easy_duphandle() properly clone the cookie status as - well. - -Version 7.9.1-pre4 - -Daniel (18 October 2001) -- CURLOPT_FAILONERROR, set with "curl --fail" no longer returns an error if - the HTTP return code is below 400. - -Daniel (17 October 2001) -- The test suite now kills any running test http server when you re-start the - tests. - -- We had to remove 'use strict' from two perl scripts, as the cygwin - adjustments didn't play nicely otherwise for some reason. Any perl wizard - out there who can put the scrict back and still make it run good on unix and - cygwin? - -- A potential memory leak pointed out to us by Yanick Pelletier was removed. - It would occur when a http file transfer fails. [http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/curl/curl/lib/transfer.c.diff?r1=1.60&r2=1.61] - -- The memory debugging system should no longer display anything to stderr - if the curl_memdebug() hasn't been used to explicitly say so. This makes it - easier to use the memory debug system and switch the logging on/off. - -Daniel (16 October 2001) -- Kevin Roth provided fixes for building curl nicer in cygwin environments. - -Daniel (12 October 2001) -- Cleaning up the progress meter/info code. The "current speed" is now more - accurate than before as we now use the true time spent between the measures, - and not just "assuming" every-second-update like before. The output should - now also be of the same width at all times, never to show "extra" zeroes on - the right edge. - -- After talking about possible Location: bugs on the mailing list, I modified - the "absolute URL" checker in lib/transfer.c to be more strict when checking - if the redirected URL is absolute. - -Daniel (11 October 2001) -- Kevin Roth provided patches that make the test suite run fine on Windows - 2000 running cygwin. - -Daniel (10 October 2001) -- Setting the -c or the CURLOPT_COOKIEJAR option now enables the cookie parser. - Previously -b or CURLOPT_COOKIEFILE was also required for the jar to work. - -Version 7.9.1-pre3 - -Daniel (9 October 2001) -- Added a new option to the command line client: -0/--http1.0. It uses the new - libcurl option CURLOPT_HTTP_VERSION to request that libcurl uses HTTP 1.0 - requests instead of the default version (1.1). It should only be used if you - really MUST do that because of a silly remote server. - -- Renamed the 'TimeCond' typedef in curl/curl.h to use a 'curl_' prefix as - all public curl-symbols should. - -- libcurl now explicitly ignores the SIGPIPE signal. - -Daniel (8 October 2001) -- Kevin Roth's change to the cookie-jar comment (in the stored file) was - applied. - -- Lucas Adamski's minor bug in the bind error code failf() was fixed. - -Daniel (5 October 2001) -- Moonesamy fixed the Curl_connecthost() function to not give compiler errors - on a bunch of compilers, due to the argument named 'socket'. - -- Moonesamy also provided updated VC++ makefiles and project files. - -Version 7.9.1-pre2 - -Daniel (4 October 2001) -- Albert Chin provided a configure patch that makes the script detect proper - gethostbyname_r() method without actually running any code, only compiling - is necessary. This also removes the need of having a resolving 'localhost' - name. - -- Found and removed memory leakage (name resolve data) in libcurl on - IPv6-enabled hosts. These could sneak through because we didn't have any - resource tracing on the IPv6-related functions. We do now. - -Daniel (3 October 2001) -- Keith McGuigan patched away a (mainly Windows-) problem with the name - resolver data being kept in the static memory area, which is removed when a - thread is killed. The curl handle itself though perfectly handles being - passed between threads. - -- Dirk Eddelbuettel reported an odd bug that turned out to be his proxy that - required an Authorization: header. Now, proxies are not supposed to require - that header, that is for true servers... - -- I accidentally ruined Georg's curl_formadd(). Uh, bad me. Corrected now. - -Version 7.9.1-pre1 - -Daniel (3 October 2001) -- Georg Huettenegger once again made an effort beyond the call of duty and not - only improved the curl_formadd() function, but also took care of adjusting - the curl command line client to use this new function instead of the - obsoleted curl_formparse. - -Daniel (2 October 2001) -- Major fix in how libcurl does TCP connects. It now does non-blocking - connects to enable good timeouts without signals, and it now tries all IP - addresses for any given host (if it resolves more than one and the first - one(s) don't connect). Added a new source file 'connect.c' to deal with all - the TCP connect stuff. - -- We now support IPv4-style IP-addresses in rfc2732-format, to better support - people writing scripts without knowing what address there is. - -Daniel (28 September 2001) -- Cleanups in the FTP source code. Divided the code into even more smaller - functions and generally tried to make the differences between IPv4 and IPv6 - get less noticable in the sources. - -- If the remote file time is not readable/accessable/understood by libcurl, - libcurl now returns -1 in the CURLINFO_FILETIME data, not 0 as it previously - did. This should make curl not touch the file data unless there was a known - remote date when -R is used. - -Daniel (27 September 2001) -- Working on getting non-blocking connects working platform independent. We - will also make curl try all IPs for a given host if the first one should - fail. - -Daniel (26 September 2001) -- Kevin Roth provided a cookie example that proved the cookie jar - functionality wasn't working properly. I added test case 46 and made it - work. - -Daniel (25 September 2001) -- Jörn Hartroth updated the mingw32 makefiles. - -Version 7.9 - -Daniel (23 September 2001) -- Found and removed a 'socket leak' that would occur on IPv6 enabled hosts - when FTP RETR failed. - -- Made the FTP upload tests run fine on machines with IPv6 enabled. - -Version 7.9-pre8 - -Daniel (19 September 2001) -- Vojtech Minarik set up a special-purpose test server and provided me with - test certificates in order for me to repeat the bug reports #440068 and - #440373. It turned out we didn't check all the error codes properly. We do - now, and connecting with a unacceptable certificate will make libcurl fail - to connect with an error code returned. - -- Ramana Mokkapati found a case when the Location: following code did wrong. - I wrote a test case for this (45). - -Version 7.9-pre7 - -Daniel (17 September 2001) -- Linus Nielsen Feltzing fixed telnet for win32. It makes libcurl require - winsock 2.0. - -Version 7.9-pre6 - -- libtool 1.4.2 is now in use! - -Version 7.9-pre5 - -Daniel (14 September 2001) -- Added another 14 ftp tests. - -Daniel (13 September 2001) -- Added curl_easy_duphandle() to the easy.h header file. It has now been - tested and proved to work in a real-world tests by T Bharath. We still need - to write up some docs for this function. - -- Added four more ftp tests to the test suite. - -Daniel (12 September 2001) -- CURLOPT_SSL_CIPHER_LIST was added, and the curl tool option is named - --ciphers. Use them to specify a list of ciphers to use in the SSL - connection. - -- T. Bharath found a memory leak in libcurl's windows version. It turned out - to be the new duphandle() that didn't quite work yet. - -Version 7.9-pre4 - -Daniel (11 September 2001) -- Added verbose output for SSL connections that output the server - certificate's start and expire dates. As suggested by Paul Harrington. - -- Heikki Korpela found problems in the perl ftp server used for the test - suite, when he runs on on OpenBSD with perl 5.6. Some changes have been - made, but nothing really certain. - -- T. Bharath has experienced problems with libcurl's stack usage on windows - and works on reducing it. - -Daniel (10 September 2001) -- Cris Bailiff fixed the perl interface. It stopped working since the changed - behavior with WRITEHEADER and NULL pointers. - -- The "output cookies" function could dump core if no cookies were enabled. - -Daniel (7 September 2001) -- SM pointed out that the SSL code didn't compile any longer if SSL was - disabled... Also, we needed to correct the #include for the utime stuff on - windows. - -Daniel (6 September 2001) -- T. Bharath pointed out a flaw in the SSL session cache code that made it - sometimes read from a NULL pointer. - -Version 7.9-pre3 - -Daniel (3 September 2001) -- Added the -R/--remote-time option, that uses the remote file's datestamp to - set the local file's datestamp. Thus, when you get a remote file your local - file will get the same time and date. Note that this only works when you use - -o or -O. - -- Installed libtool 1.4.1, libtoolized and everything. - -Daniel (1 September 2001) -- Heikki Korpela pointed out that I did not ship the proper libtool stuff in - the pre-releases, even though that was my intention. libtoolize has now - been re-run. - -- Heikki also patched away the bad use of 'make -C' in the test suite - makefile. make -C is not very portable and is now banned from here. - -Version 7.9-pre2 - -Daniel (31 August 2001) -- I just made a huge internal struct rehaul, and all the big internally used - structs have been renamed, redesigned and stuff have been moved around a bit - to make the source easier to follow, more logically grouped and to hopefully - decrease future bugs. I also hope that this will make new functions to get - easier to add, and make it less likely that we have bugs left like the URL- - free bug from August 23. - -Version 7.9-pre1 - -Daniel (29 August 2001) -- The new cookie code have enabled the brand new '-c/--cookie-jar' option. Use - that to specify the file name in which you want to have all cookies curl - knows of, dumped to. It'll be written using the netscape cookie format. - - This is internally done with the new CURLOPT_COOKIEJAR option to libcurl, - which in turn dumps this information when curl_easy_cleanup() is invoked. - There might be reasons to re-consider my choice of putting it there. Perhaps - it is better placed to get done just before *_perform() is done. It is all - of course depending on how you guys want to use this feature... - -- Added ftpupload.c in the source examples section, based on source code posted - by Erick Nuwendam. - -Daniel (28 August 2001) -- Now running libtool CVS branch-1-4 to generate stuff. Should fix problems - on OpenBSD and hopefully on FreeBSD as well! - -- Georg Huettenegger modified the curl_formadd() functionality slightly, and - added support for error code 417 when doing form post and using the Expect: - header. Great work! - -- Made some tests with cached SSL session IDs, and they seem to work. There - should be a significant speed improvement in the SSL connection phase, but - in my tiny tests it just isn't possible to notice any difference. Like other - caching in libcurl, you must reuse the same handle for the caching to take - effect. SSL session ID caching is done on a per host-name and destination - port number basis. - - Set verbose, and you'll get informational tests when libcurl detects and - uses a previous SSL session ID. - -- Upgraded to automake 1.5 on my development/release machine. - -Daniel (27 August 2001) -- Slowly started writing SSL session ID caching code - -Daniel (24 August 2001) -- T. Bharath removed compiler warnings on windows and updated the MS project - files. - -- Kevin Roth reported two kinds of command line constructs with the new -G that - curl didn't really deal with the way one would like. - -- Tim Costello patched away a use of strcasecmp() in the SSL code. We have our - own portable version named strequal() that should be used! - -- Tim also pointed out a problem in the lib/Makefile.vc6 file that made it mix - debug object modules causing confusions. - -Daniel (23 August 2001) -- T. Bharath accurately found a libcurl bug that would happen when doing a - second invoke of curl_easy_perform() with a new URL when the previous invoke - followed a Location: header. - -- Started the improvement work on the cookie engine: - - Now keeps cookies in the same order as the cookie file - - A write to the possibly static string was removed - - Added a function that can output all cookies - - Now supports reading multiple cookie files - -- Steve Lhomme corrected a DLL naming issue in the MSVC++ project file. - -- Split up the monster function in lib/ftp.c to use more smallish functions to - increase readability and maintainability. - -Daniel (21 August 2001) -- Georg Huettenegger's big patch was applied. Now we have: - o "Expect: 100-continue" support. We will from now on send that header in - all rfc1867-posts, as that makes us abort much faster when the server - rejects our POST. Posting without the Expect: header is still possible in - the standard replace-internal-header style. - o curl_formadd() is a new formpost building function that is introduced to - replace the now deprecated curl_formparse() function. The latter function - will still hang around for a while, but the curl_formadd() is the new way - and correct way to build form posts. - o Documentation has been updated to reflect these changes - - These changes are reason enough to name the next curl release 7.9... - -- We now convert man pages to HTML pages and include them in the release - archive. For the pleasure of everyone without nroff within reach. - -- Andrés García's suggested flushing of the progress meter output stream was - added. It should make the progress meter look better on Windows. - -- Troy Engel pointed out a mistake in the configure script that made it fail - on many Red Hat boxes! - -Daniel (20 August 2001) -- We need an updated libtool to make a better build environment for OpenBSD - as well as FreeBSD - -Version 7.8.1 - -Daniel (20 August 2001) -- Brad pointed out that we ship two extra libtool files in the tarballs that - we really don't need to! Removing them makes the gz-archive about 60K - smaller! - -- Albert Chin brought fixes for the configure script to detect socklen_t - properly as well as moving lots of our custom autoconf macros to - acinclude.m4. - -Daniel (19 August 2001) -- Moonesamy improved his -G feature for host names only URLs... - -Daniel (17 August 2001) -- Finally cleaned up the kerberos code to use Curl_ prefixes on all global - symbols and to not use global variables. - -Version 7.8.1-pre6 - -Daniel (16 August 2001) -- S. Moonesamy added the -G option to curl, that converts the data specified - with -d to a GET request. Default action when using -d is POST. When -G is - used, the -d specified data will be appended to the URL with a '?' - separator. As suggested previously by Kevin Roth. - -- curl-config --libs should now display all linker options required to link - with libcurl. It includes the path and options for libcurl itself. - curl-config --cflags displays the compiler option(s) needed to compile - source files that use libcurl functions. Basically, that sets the include - path correct. - -Daniel (15 August 2001) -- Arkadiusz Miskiewicz pointed out a mistake in how IPv6-style IP-addresses - were parsed and used. (RFC2732-format) - -- Bug #12733 over on php.net identified a problem in libcurl that made it core - dump if you used CURLOPT_POST without setting any data to post with - CURLOPT_POSTFIELDS! This is no longer the case. Not using CURLOPT_POSTFIELDS - now equals setting it to no data at all. - -- Ramana Mokkapati reported that curl with '-w %{http_code}' didn't work - properly when used for multiple URLs on a single command line. Indeed, the - variable was not reset between the requests. This is now fixed. - -- David James fixed the Borland makefile so that libcurl still compiles and - builds with that compiler. - -Daniel (14 August 2001) -- Oops. I ruined Nico's socklen_t define in config-vms.h, corrected it now. - -- An older item not mentioned here before: CURL_GLOBAL_WIN32 is a define for - windows users to curl_global_init(), that makes libcurl init the winsock - stuff. If libcurl is all socket stuff you do, then allowing it to fiddle - with this is a comfortable shortcut to fame. - -Version 7.8.1-pre5 - -Daniel (14 August 2001) -- Nico Baggus provided more feedback from his VMS porting efforts and a few - minor changes were necessary. - -- I modified configure.in so that --enable-debug sets more picky gcc options. - I then removed almost all the new warnings that appeared, and by doing so I - corrected the size_t-treated-as-signed problem that has been discussed on - the mailing list previously. I also removed a bunch of the just recently - added #ifdef VMS lines. - -- I removed the use of a global variable in the SSL code. It was once - necessary but hasn't been needed since OpenSSL 0.9.4. The old code should - (hopefully) still work if libcurl is built against an ancient version of - OpenSSL. - -Daniel (13 August 2001) -- Peter Todd posted a patch that now allows non-file rc1867-style form posts - to be larger than 4K. - -Daniel (10 August 2001) -- S. Moonesamy fixed bugs for building debug and SSL lib in VC makefile - -Daniel (9 August 2001) -- The redirected error stream was closed before the curl_easy_cleanup() call - was made, and when VERBOSE was enabled, the cleanup function tried to use - the stream. It could lead to a segmentation fault. Also, the stream was - closed even if we looped to get more files. Corrects Dustin Boswell's bug - report #441610 - -- Now generates the release configure script with autoconf 2.52 - -Version 7.8.1-pre4 - -Daniel (8 August 2001) -- curl -E uses a colon to separate a file name from a passphrase. This turned - out really bad for the windows people who wants to include a drive letter in - the file name like "c:\cert.pem". There's now a win32 work-around - implemented that tries work around that, when the colon seems to be used for - this kind of construct. - -- Patrick Bihan-Faou introduced CURLOPT_SSL_VERIFYHOST, which makes curl - verify the server's CN field when talking https://. If --cacert is not used, - any failures in matching is only displayed as information (-v). - -Daniel (7 August 2001) -- Wrote up nine more test cases, more or less converted from the former test - suite. - -Daniel (6 August 2001) -- Heikki Korpela posted a patch that makes 'curl-config --libs' include the - directory in which libcurl itself is installed in. While this wasn't my - initial intention with this option, it makes sense and makes linking with - libcurl easier. - -- Stefan Ulrich pointed out to us that other tools and libraries treat file:// - URLs with only one slash after the host name slighly different than libcurl - does. Since all the others seem to agree, we better follow them. - -- Nico Baggus provided us with a huge set of fixes to make curl compile and - build under OpenVMS. - -Version 7.8.1-pre3 - -Daniel (6 August 2001) -- Jonathan Hseu noticed that you couldn't get a header callback unless you - set CURLOPT_WRITEHEADER to non-NULL, even if you didn't care about that - data. This is now fixed. - -Daniel (5 August 2001) -- Sergio Ballestrero provided a patch for reading responses from NCSA httpd - 1.5.x servers, as they return really screwed up response headers when asked - for with HTTP 1.1. - -- curl_escape() no longer treats already encoded characters in the input - string especially. - -Daniel (3 August 2001) -- I replaced the former lib/arpa_telnet.h file with one I wrote myself, to - avoid the BSD annoucement clause of the license in the former file. - -- Andrew Francis provided a new version of base64.c to work around the license - boiler plate that came with the previous one. I patched it, but the glory - should go to Andrew for his heads up. - -- Tomasz Lacki noticed that when you do repeated transfers with libcurl you - couldn't always reliably change HTTP request. This has now been fixed and a - new libcurl option was added: CURLOPT_HTTPGET, that can force the HTTP - requestr (back) to GET. - -- Linus Nielsen Feltzing pointed out that httpsserver.pl wasn't included in - release archives. It should be now. - -Daniel (2 August 2001) -- Frank Keeney pointed out a manual mistake for certificate convertions. - -- Tomasz Lacki pointed out a problem in the transfer loop that could make the - select() loop use far too much CPU. - -- Pawel A. Gajda pointed out an output mistake done when using libcurl's - progress callback. - -Daniel (29 June 2001) -- Naveen Noel noticed that the Borland library makefile wasn't updated. - -- Nic Roets brought a fix for the certificate verification when using SSL. - -Daniel (27 June 2001) -- Made the FTP tests run OK even on machines running curl IPv6-enabled. - -- Troy Engel corrected some RPM package details. - -Version 7.8.1-pre2 - -Daniel (25 June 2001) -- Björn Stenberg correctly identified a problem that occurred when downloading - several files with curl, and using resume. The first file's resume index was - then used for all files, resulting in weird results... - -- Anton Kalmykov provided a fix that makes curl work with form field names - with spaces like when -F is used. - -Version 7.8.1-pre1 - -Daniel (20 June 2001) -- Mike Bytnar provided a fine report that proved that the --with-ssl option - for configure needed tweaking. It no longer searches the default directories - for OpenSSL libs or directories when a specified path is given. - -Daniel (19 June 2001) -- When an FTP transfer is cut off during transfer, curl could present a truly - garbaged error message and in worst case dump core. Thanks to detailed - reports from Shawn Poulson we nailed this. - -Daniel (12 June 2001) -- Salvador Dávila provided a fix for FTP range downloads. - -- Added a few more test cases from the former test suite to the new file - format. We're now at a total of 26 tests. - -Daniel (11 June 2001) -- libcurl's version-info was wrong, as noted by both Domenico Andreoli and - David Odin. - -Daniel (7 June 2001) -- Jörn fixed the curl_unescape duplicate entry in lib/libcurl.def - -- I made SSL certificate failure messages to be more detailed. - -Version 7.8 - -Daniel (7 June 2001) -- SDavila provided a resumed download fix. - -Version 7.8-pre4 - -Daniel (1 June 2001) -- Sterling provided some new PHP examples. - -- Changed the CVS hierarchy and the older checkout instruction does no longer - work. We moved the entire source code into a CVS module named 'curl'. - -Daniel (31 May 2001) -- CURLOPT_MUTE does not exist anymore. It is still present in the include file - to not cause compiler errors for applications using it, but it isn't used - anywhere in the library. - -Version 7.8-pre3 - -Daniel (31 May 2001) -- Once and for all fixed the _REENTRANT mess for Solaris compiles to present - less warnings. - -- Sterling Hughes tirelessly points out and corrects my mistakes...! So, - curl_global_init() now lets the argument flags *SET* what parts to - init. CURL_GLOBAL_DEFAULT makes a nice default, CURL_GLOBAL_ALL inits all - known subsystems and CURL_GLOBAL_NONE inits nothing more than absolutely - necessary. Man page updated accordingly. - -- Fixed the strtok.h include file as it wouldn't compile on all platforms! - -Daniel (30 May 2001) -- Made libcurl by default act as if CURLOPT_MUTE and CURLOPT_NOPROGRESS were - set TRUE. Set them to FALSE to make libcurl more talkative. The *_MUTE - option is subject for complete removal... - -Version 7.8-pre2 - -Daniel (30 May 2001) -- Cris Bailiff wrote a makefile for building Solaris packages. - -- Sterling Hughes brought fixes for 'buildconf' (the build-from-CVS tool) and - we discussed and added a few CURL_GLOBAL_* flags in include/curl.h - -- Kjetil Jacobsen privately announced his python interface to libcurl, - available at http://pycurl.io/ - -Daniel (29 May 2001) -- Sterling Hughes fixed a strtok() problem in libcurl. It is not a thread- - safe function. Now configure checks for a thread-safe version, and - lib/strtok.c offers one for the systems that don't come with one included! - -- Mettgut Jamalla correctly pointed out that the -# progress bar was written - to stderr even though --stderr redirection was used. This is now corrected. - -- I moved out the list of contributors from the curl.1 man page and made a - separate docs/THANKS file. It makes the list easier to find, and made it - easier for me to make a separate web page with that same information. - - I really do want all you guys mentioned in there to feel you get the credit - you deserve. - -- lib/easy.c didn't compile properly in the 7.8-pre1 due to a silly mistake - -Version 7.8-pre1 - -Daniel (28 May 2001) -- curl-config now supports '--vernum' that outputs a plain hexadecimal version - of the libcurl version number (using 8 bits for each 3 numbers). Version - 7.7.4 appears as 070704 - -- Wrote man pages for curl_global_init and curl_global_cleanup... - -- T. Bharath brought news about the usage of the OpenSSL interface that was - not previously taken into consideration and thus caused libcurl to leak - memory. The only somewhat sane approach to fix this dilemma, is adding two - two new functions curl_global_init() and curl_global_cleanup() that should - be called *ONCE* by the application using libcurl. The init should be done - only at startup, no matter how many threads the application is gonna use, - and the cleanup should be called when the application has finished using - libcurl completely. - - *** UPGRADE NOTICE *** - - If you write applications using libcurl, you really want to use the two - functions mentioned above !!! - - I can't say I think this is a very beautiful solution, but as OpenSSL - insists on making lots of stuff on a "global" scope, we're forced to walk - the path they point us to. - -- Moving more test cases into the new file format. - -Version 7.7.4-pre3 - -Daniel (23 May 2001) -- Introduced a new file format for storing test cases, and thus I had to - modify all the perl test scripts and more (I added a new one). I have not - "ported" all the old test cases to the new format yet, but it'll come. - - The main advantage of this new format is that all test data for each test - case is stored in a single file. It gives a better overview for each test - case and a lot less files. - -- Andrés García brought a fix for the netscape/mozilla cookie file parsing - function, as it turns out it doesn't always store the path! - -Daniel (22 May 2001) -- As was reported anonymously, when FAILONERROR was used, the httpcode was - not stored properly and thus wasn't possibly to read after a transfer with - the curl_easy_getinfo() function. This is now corrected. - -- Installed and made use of the following tool versions: - autoconf 2.50 - libtool 1.4 - automake 1.4-p1 - - I wouldn't recommend any developer to try to generate things with older - versions than these. Building from CVS will probably more or less require - at least these versions. - - As a result of this, the configure script grew to more than double its - previous size! - - Arkadiusz Miskiewicz helped me by pointing out I had to remove my - acinclude.m4 file before I could get it working! - -Daniel (21 May 2001) -- I made ftps:// work. Added test case 400 to the release archive, as the - first ftps:// test case. Requires stunnel. - -- Also made the test cases that runs ssl tests not run if libcurl isn't built - with ssl support. - -Daniel (19 May 2001) -- Made the configure not add any extra -L LDFLAGS or -I CPPFLAGS unless they - are actually needed. Albert Chin's and Domenico Andreoli's suggestions - helped out. - -Version 7.7.4-pre2 - -Daniel (18 May 2001) -- Nicer configure-check for the OpenSSL headers, which then sets the proper - variable to have curl-config be good. (Albert Chin provided the fix) - -- For systems that don't have theiw own 'strlcat()' libcurl provides its own. - It was now renamed to prevent collides with other libs. (After discussions - with Sterling Hughes and the implications this had on PHP builds.) - -Daniel (17 May 2001) -- Colm Buckley posted a detailed bug report on (the debianized) 7.7.3, that - turned out to be a problem with the debian-built 7.7.3-package that - contained files from the 7.7.2 release! - -- I added the CURLE_ALREADY_COMPLETE again, but with a fake value, just to - make programs that use it, not fail when compiling against this version of - libcurl. - -Daniel (14 May 2001) -- Pawel A. Gajda fixed a problem with resumed transfers on re-used persistent - connections. - -Version 7.7.4-pre1 - -Daniel (14 May 2001) -- Jun-ichiro itojun Hagino fixed FTP PORT for IPv6-enabled libcurl. - -- Added the first HTTPS test to the test suite in the release archive. - -Daniel (12 May 2001) -- Jukka Pihl suggested that if (lib)curl is told to verify the peer's - certificate and the peer can't be verified, it should fail and return a - proper error code. I added a brand new error code named - CURLE_SSL_PEER_CERTIFICATE for this purpose. - -Daniel (11 May 2001) -- As was discussed with Frederic Lepied a while ago, I now made libcurl not - return error even though no data was transfered on upload/download resume - when the no transfer is needed. The CURLE_ALREADY_COMPLETE error was removed - from the header file to make any implemenator that uses that to be aware of - the fact that it can't be returned anymore! - -- Improved general header-parsing to better allow white spaces and more. - -- Rodney Simmons proved the fix I did yesterday was bad and I had to post - another one. - -- Ingo Wilken patched away two redirect problems more! - -Daniel (10 May 2001) -- Cris Bailiff correctly noted that the space-after-header problem with - Location: is present on several other places in the libcurl sources. - -- Ingo Wilken patched away a problem libcurl had when following Location: - headers with an extra space after the colon. - -- Rodney Simmons found out that multiple FTP transfers did not treat relative - directories correctly. - -Daniel (9 May 2001) -- Getting an FTP file with CURLOPT_NOBODY set (or -I from the command line), - makes curl use the non-standard ftp command "SIZE". If it failed, libcurl - returned error. Starting now, it just don't output the file size instead. - Anonymous bug report. - -- stunnel.pm was accidentally left out from the release archive, it is now - added (stunnel is needed to run the https-tests in the test suite) - -Daniel (7 May 2001) -- Corrected two minor compiler warnings due to the FILE * to void * conversion - that I missed at two places. Jörn Hartroth brought me patches. Sander Gates - filed a bug report on this. - -Version 7.7.3 - -Daniel (4 May 2001) -- All callback functions now take 'void *' instead of 'FILE *'. This is made - this way to make it more obvious to people that anything can be passed to - them (by using the apropriate option). After discussions with Sterling - Hughes. - -Daniel (3 May 2001) -- Cris Bailiff fixed a chunked transfer encoding problem with persistent - connection that made libcurl fail if the persistent connection used mixed - chunked and non-chunked transfers. - -- Cris Bailiff fixed a bad treatment of 304-replies, as they would not be - treated as content-length 0 replies but would cause a "hang" until the - server timed-out and closed the connection. - -- Brad Burdick found a minor problem in the docs/examples/Makefile.am - -Daniel (27 April 2001) -- Updated the INTERALS document again. It was lagging a bit. I think I made it - more easy to follow now as well. - -- Brad Burdick found a problem with persistent connections when curl received - a "Content-Length: 0" header. - -- Giuseppe D'Ambrosio was first out to report that TELNET doesn't work in curl - compiled/built on win32. It seems to work for unixes though! - -- Dave Hamilton reported weird problems with CURL/PHP that I really can't - explain at the moment. I'm hoping on some help from the PHP crew. - -Daniel (26 April 2001) -- I rewrote the FTP command response function. I had to do it to make ftps - work, as the OpenSSL read()-function didn't work the same way the normal - unix read() does, but it was also a huge performance boost. Previously the - function read one byte at a time, now it reads very large chunks, and it - makes a notable speed difference. - -Daniel (25 April 2001) -- Connection re-use when not using a proxy didn't work properly for - non-default port numbers. - -Daniel (24 April 2001) -- I've noticed that FTPS doesn't work. We attempt to use ssl even for the - data transfer, which causes the transfer to 'hang'... We need to fix this. - -- Improved the test suite to use 'stunnel' to do HTTPS and FTPS testing on - the alredy written perl servers easily. - -Daniel (23 April 2001) -- The OpenSSL version string recently modified didn't zero terminate one - of the generated strings properly, which could lead to a crash or simply - weird version string output! - -Version 7.7.2 - -Daniel (22 April 2001) -- Rosimildo da Silva updated the Makefiles for Borland/Windows. - -- Eric Rautman pointed out a problem with persistent connections that would - lead to broken Host: headers in the second HTTP request. - -Daniel (20 April 2001) -- Added man pages for the curl_strequal() and curl_mprintf() families. Wrote - a 'libcurl overview' man page. - -- Spell-fixed some documents. - -- S. Moonesamy corrected mistakes in the man page. - -- Cris Bailiff fixed the curl_slists options in the perl interface, present - separately in the Curl::easy 1.1.4 package. - -Daniel (19 April 2001) -- Linus Nielsen Feltzing removed the decimals from the size variables in the - --write-out output. We hardly ever get fraction of bytes! :-) - -Version 7.7.2-pre1 - -Daniel (19 April 2001) - -- Albert Chin provided a configure patch for the AC_SYS_LARGEFILE macro. - -Daniel (18 April 2001) -- Input from Michael Mealling made me add --feature to curl-config. It - displays a list of features that have been built-in in the current - libcurl. The currently available features that can be listed are: SSL, KRB4 - and IPv6. - -- I committed Cris and Georg's perl interface work. They've got callbacks - working and options that receives those slist pointers. - -- Puneet Pawaia detected a problem with resumed downloads that use persistent - connections and I made a rather large writeup to correct this. It is - important that all session-data is stored in the connectdata struct and not - in the main struct as this previously did. - -Daniel (17 April 2001) -- Frederic Lepied fixed a ftp resumed download problem and introduced a new - error code that lets applications be able to detect when a resumed download - actually didn't download anything since the whole file is already present. - Should this return OK instead? - -- I added 'curl-config.in' to the root dir and configure script. Now, a - curl-config script is made when curl is built. The script can be used to - figure out compile time options used when libcurl was built, which in turn - should be options YOU should use to build applications that use libcurl. - - This *-config style is not a new idea, but something that has been used - successfully in other (library based) projects. - -- Phil Karn pointed out that libcurl wrongly did not always use GMT time zone - for the If-Modified-Since style headers. - -- Georg Schwarz pointed out an extra needed #include file needed in src/main.c - for curl to build on Ultrix. - -Daniel (11 April 2001) -- Cris Bailiff pointed out two problems that I corrected. First, libcurl's use - of the environment variable HTTP_PROXY in uppercase may become a security - hazard when people use libcurl in a server/cgi situation where the server - sets the HTTP_*-variables according to incoming headers in the HTTP - request. Thus, a "Proxy:"-header would set that environment variable! - - Then, invoking curl_easy_perform() without having an URL set caused a crash. - -- S. Moonesamy brought a patch that make curl use non-blocking connects on - windows when connection timeout is set, as it allows windows users to set - that timeout! - -- Hirotaka Matsuyuki wrote a Ruby interface to libcurl! - -- Cris Bailiff, Forrest Cahoon and Georg Horn work on the Perl interface. - -- I've written a first shot at a Java interface to libcurl. Many thanks to - Daniel Marell for tirelessly answering to all my basic Java questions. It - works, but it is still very basic. - -Daniel (10 April 2001) -- The progress display could get silly when doing multiple file transfers, as - it wasn't properly reset between transfers! - -- Discussions with Cris Bailiff who writes a Perl interface to libcurl, made - me add CURLOPT_HEADERFUNCTION. It can be used to set a separate callback - function for writing headers. Previously you could only set a different FILE - * when headers are written from within libcurl. - -Daniel (7 April 2001) -- Andrés García fixed a problem in curl_escape() and pointed out a flaw in - the curl_easy_setopt man page. - -Daniel (6 April 2001) -- Adjusted the version code to properly display OpenSSL 0.9.6a. They sure - change their version define format often... - -- curl_formfree() now accepts a NULL pointer without crashing! - -Version 7.7.1 - -Daniel (3 April 2001) -- Puneet Pawaia pointed out two serious problems. Libcurl would attempt to - read bad memory during situations when an (ftp) connection attempt failed. - Also, the lib/Makefile.vc6 was corrected. - -- More investigations in the Location: following code made me realize that - it was not clean enough to work transparantly with persistent and non- - persistent connections. I think I've fixed it now. - -Daniel (29 March 2001) -- Georg Horn mailed me some corrections for the Curl::easy perl interface. - -- Experimental ftps:// support added. It is basically FTP over SSL for the - control connection. It still makes all data transfers going over unencrypted - connections. Rainer Weikusat's ftpd-ssl server hack supports this and I used - that to verify the functionality. - -Daniel (27 March 2001) -- Guenole Bescon discovered that if you set a CURLOPT_TIMEOUT and then tried - to get a file from a site and it fails, the SIGALRM would still be sent - after the timeout-time, quite inexpectedly! - -- I added an ftp transfer example to docs/examples/ and I also wrote a tiny - example makefile that can be used as a start when building one of the - examples. - -Version 7.7.1-beta1 - -Daniel (26 March 2001) -- Mohamed Lrhazi reported problems with 7.6.1 and persistent HTTP/1.0 - connections (when the server replied a Connection: Keep-Alive) and this - problem was not properly dealt with in 7.7 either. A patch was posted to the - curl-and-php mailing list. - -Daniel (24 March 2001) -- Colin Watson reported about a problem and brought a patch that corrected it, - which was about the man page and lines starting with a single quote (') in a - way that gnroff doesn't like. - -Daniel (23 March 2001) -- Peter Bray reported correctly that the root makefile used make instead of - $(MAKE) for the test target. - -- Corrected the Curl::easy perl interface to use curl_easy_setopt() and not - curl_setopt() which was removed in 7.7! - -- S. Moonesamy provided updates on three documents (MANUAL, INSTALL and FAQ). - -- When following a Location:, libcurl would sometimes write to the URL string - in a way it shouldn't. As the pointer is passed-in to libcurl from an - application, we can't be allowed to write to it. The particular bug report - from 'nk' that brought this up was because he had a read-only URL that then - caused a libcurl crash! - -- No longer reads HEAD responses longer than to the last header. Previously, - curl would read the full reply if the connection was a "close" one. - -- libcurl did re-use connections way too much. Doing "curl - http://www.{microsoft,ibm}.com" would make it re-use the connection which - made the second request return very odd results. - -Daniel (22 March 2001) -- Edin Kadribasic made me aware that curl should not re-send POST requests - when following 302-redirects. I made 302 work like 303 which means curl uses - GET in the following request(s). - -- libcurl now reset the "followed-location" counter on each invoke of - curl_easy_perform() as it otherwise would sum up all redirects on the same - connection and thus could reach the maxredirs counter wrongly. - -- Jim Drash suggested curl_escape() should not re-encode what already looks - like an encoded sequence and I think that's a fair suggestion. - -Version 7.7 - -Daniel (22 March 2001) -- The configure script now fails with an error message if gethostbyname_r() is - detected but it couldn't figure out how to invoke it (what amount of - arguments it is supposed to get). Reports from Andrés García made me aware - of this need. - -- Talking with Jim Drash made me finally put the curl_escape and curl_unescape - functions in the curl.h include file and write man pages for them. The - escape function was modified to use the same interface as the unescape one - had. - -- No bug reports at all on the latest betas. Release time coming up. - -Version 7.7-beta5 - -Daniel (19 March 2001) -- Georg Ottinger reported problems with using -C together with -L in the sense - that the -C info got lost when it was redirected. I could not repeat this - problem on the 7.7 branch why I leave this for the moment. Test case 39 was - added to do exactly this, and it seems to do right. - -- Christian Robottom Reis reported how his 7.7 beta didn't successfully do - form posts as elegantly as 7.6.1 did. Indeed, this was a flaw in the header - engine, as HTTP 1.1 has introduced a new 100 "transient" return code for PUT - and POST operations that I need to add support for. Section 8.2.3 in RFC2616 - has all the details. Seems to work now! - -Daniel (16 March 2001) -- After having experienced another machine break-down, we're back. - -- Georg Horn's perl interface Curl::easy is now included in the curl release - archive. The perl/ directory is now present. Please help me with docs, - examples and updates you think fit. - -- Made a new php/ directory in the release archive and moved the PHP examples - into a subdirectory in there. Not much PHP info yet, but I plan to. Please - help me here as well! - -- Made libcurl return error if a transfer is aborted in the middle of a - "chunk". It actually enables libcurl to discover premature transfer aborts - even if the Content-Length: size is unknown. - -Daniel (15 March 2001) -- Added --connect-timeout to curl, which sets the new CURLOPT_CONNECTTIMEOUT - option in libcurl. It limits the time curl is allowed to spend in the - connection phase. This differs from -m/--max-time that limits the entire - file transfer operation. Requested by Larry Fahnoe and others. - - I also updated the curl.1 and curl_easy_setopt.3 man pages and removed the - item from the TODO. - -Version 7.7-beta4 - -Daniel (14 March 2001) -- Made curl grok IPv6 with HTTP proxies and got everything to compile nicely - again when ENABLE_IPV6 is set. - - I need to remake things in the test suite. I can't test the FTP parts with - curl built for IPv6 as it uses a different set of FTP commands then! - -- I fell onto a bug report on php.net (posted by Lars Torben Wilson) that was - a report meant for our project. Anyway, it said the .netrc parsing didn't - work as supposed, and as I agreed with Lars, I made the netrc parser use - getpwuid() to figure out the home directory of the effective user and try - that netrc. It still uses the environment variable HOME for those that don't - have that function or if the user doesn't return valid pwd info. - -- Edin Kadribaic posted a bug report where he got a crash when a fetch with - user+password in the URL followed a Location: to a second URL (absolute, - without name+password). This bug has been around for a long while and - crashes due to a read at address zero. Fixed now. Wrote test case 38, that - tests this. - -- Modified the test suite's httpserver slightly to append all client request - data to its log file so that the test script now better can verify a range - of requests and not only the last one, as it did previously. - -- Updated the curl man page with --random-file and --egd-file details. - -Version 7.7-beta3 - -Daniel (14 March 2001) -- Björn Stenberg provided similar fixes as Jörn did and some additional patches - for non-SSL compiles. - -- I increased the interface number for libcurl as I've removed the low level - functions from the interface. I also took this opportunity to rename the - Curl_strequal function to curl_strequal and Curl_strnequal to - curl_strnequal, as they're public libcurl functions (even if they're still - undocumented). - - This will make older programs not capable of using the new libcurl with - just a drop-in replacement. - -- Jörn Hartroth updated stuff for win32 compiles: - o config-win32.h was fixed for socklen_t - o lib/ssluse.c had a bad #endif placement - o lib/file.c was made to compile on win32 again - o lib/Makefile.m32 was updated with the new files - o lib/libcurl.def matches the current interface state - -Daniel (13 March 2001) -- It only took an hour or so before Jörn Hartroth found a problem in the - chunked transfer-encoding. Given his fine example-site, I could easily spot - the problem and when I re-read the spec (the part I have pasted in the top - of the http_chunks.h file), I realized I had made my state-machine slightly - wrong and didn't expect/handle the trailing CRLF that comes after the data - in each chunk (and those extra two bytes sure feel wasted). - - Had to modify test case 34 to match this as well. - -Version 7.7-beta2 - -Daniel (13 March 2001) -- Added the policy stuff to the curl_easy_setopt man page for the two supported - policies. - -- Implemented some support for the CURLOPT_CLOSEPOLICY option. The policies - CURLCLOSEPOLICY_LEAST_RECENTLY_USED and CURLCLOSEPOLICY_OLDEST are now - supported, and the "least recently used" is used as default if no policy - is chosen. - -Daniel (12 March 2001) -- Added CURLOPT_RANDOM_FILE and CURLOPT_EGDSOCKET to libcurl for seeding the - SSL random engine. The random seeding support was also brought to the curl - client with the new options --random-file <file> and --egd-file <file>. I - need some people to really test this to know they work as supposed. Remember - that libcurl now informs (if verbose is on) if the random seed is considered - weak (HTTPS connections). - -- Made the chunked transfer-encoding engine detected bad formatted data length - and return error if so (we can't possibly extract sensible data if this is - the case). Added a test case that detects this. Number 36. Now there are 60 - test cases. - -- Added 5 new libcurl options to curl/curl.h that can be used to control the - persistent connection support in libcurl. They're also documented (fairly - thoroughly) in the curl_easy_setopt.3 man page. Three of them are now - implemented, although not really tested at this point... Anyway, the new - implemented options are named CURLOPT_MAXCONNECTS, CURLOPT_FRESH_CONNECT, - CURLOPT_FORBID_REUSE. The ones still left to write code for are: - CURLOPT_CLOSEPOLICY and its related option CURLOPT_CLOSEFUNCTION. - -- Made curl (the actual command line tool) use the new libcurl 7.7 persistent - connection support by re-using the same curl handle for every specified file - transfer and after some more test case tweaking we have 100% test case OK. - I made some test cases return HTTP/1.0 now to make sure that works as well. - -- Had to add 'Connection: close' to the headers of a bunch of test cases so - that curl behaves "old-style" since the test http server doesn't do multiple - connections... Now I get 100% test case OK. - -- The curl.haxx.se site, the main curl mailing list and my personal email are - all dead today due to power blackout in the area where the main servers are - located. Horrible. - -- I've made persistance work over a squid HTTP proxy. I find it disturbing - that it uses headers that aren't present in any HTTP standard though - (Proxy-Connection:) and that makes me feel that I'm now on the edge of what - the standard actually defines. I need to get this code excercised on a lot - of different HTTP proxies before I feel safe. - - Now I'm facing the problem with my test suite servers (both FTP and HTTP) - not supporting persistent connections and libcurl is doing them now. I have - to fix the test servers to get all the test cases do OK. - -Daniel (8 March 2001) -- Guenole Bescon reported that libcurl did output errors to stderr even if - MUTE and NOPROGRESS was set. It turned out to be a bug and happens if - there's an error and no ERRORBUFFER is set. This is now corrected. - -Version 7.7-beta1 - -Daniel (8 March 2001) -- "Transfer-Encoding: chunked" is no longer any trouble for libcurl. I've - added two source files and I've run some test downloads that look fine. - -- HTTP HEAD works too, even on 1.1 servers. - -Daniel (5 March 2001) -- The current 57 test cases now pass OK. It would suggest that libcurl works - using the old-style with one connection per handle. The test suite doesn't - handle multiple connections yet so there are no test cases for this. - -- I patched the telnet.c heavily to not use any global variables anymore. It - should make it a lot nicer library-wise. - -- The file:// support was modified slightly to use the internal connect-first- - then-do approach. - -Daniel (4 March 2001) -- More bugs erased. - -Version 7.7-alpha2 - -Daniel (4 March 2001) -- Now, there's even a basic check that a re-used connection is still alive - before it is assumed so. A few first tests have proven that libcurl will - then re-connect instead of re-use the dead connection! - -Daniel (2 March 2001) -- Now they work intermixed as well. Major coolness! - -- More fiddling around, my 'tiny' client I have for testing purposes now has - proved to download both FTP and HTTP with persistent connections. They do - not work intermixed yet though. - -Daniel (1 March 2001) -- Wilfredo Sanchez pointed out a minor spelling mistake in a man page and that - curl_slist_append() should take a const char * as second argument. It does - now. - -Daniel (22 February 2001) -- The persistent connections start to look good for HTTP. On a subsequent - request, it seems that libcurl now can pick an already existing connection - if a suitable one exists, or it opens a new one. - -- Douglas R. Horner mailed me corrections to the curl_formparse() man page - that I applied. - -Daniel (20 February 2001) -- Added the docs/examples/win32sockets.c file for our windows friends. - -- Linus Nielsen Feltzing provided brand new TELNET functionality and - improvements: - - * Negotiation is now passive. Curl does not negotiate until the peer does. - * Possibility to set negotiation options on the command line, currently only - XDISPLOC, TTYPE and NEW_ENVIRON (called NEW_ENV). - * Now sends the USER environment variable if the -u switch is used. - * Use -t to set telnet options (Linus even updated the man page, awesome!) - -- Haven't done this big changes to curl for a while. Moved around a lot of - struct fields and stuff to make multiple connections get connection specific - data in separate structs so that they can co-exist in a nice way. See the - mailing lists for discussions around how this is gonna be implemented. Docs - and more will follow. - - Studied the HTTP RFC to find out better how persistent connections should - work. Seems cool enough. - -Daniel (19 February 2001) -- Bob Schader brought me two files that help set up a MS VC++ libcurl project - easier. He also provided me with an up-to-date libcurl.def file. - -- I moved a bunch of prototypes from the public <curl/curl.h> file to the - library private urldata.h. This is because of the upcoming changes. The - low level interface is no longer being planned to become reality. - -Daniel (15 February 2001) -- CURLOPT_POST is not required anymore. Just setting the POST string with - CURLOPT_POSTFIELDS will switch on the HTTP POST. Most other things in - libcurl already works this way, i.e they require only the parameter to - switch on a feature so I think this works well with the rest. Setting a NULL - string switches off the POST again. - -- Excellent suggestions from Rich Gray, Rick Jones, Johan Nilsson and Bjorn - Reese helped me define a way how to incorporate persistent connections into - libcurl in a very smooth way. If done right, no change may have to be made - to older programs and they will just start using persistent connections when - applicable! - -Daniel (13 February 2001) -- Changed the word 'timeouted' to 'timed out' in two different error messages. - Suggested by Larry Fahnoe. - -Version 7.6.1 - -Daniel (9 February 2001) -- Frank Reid and Cain Hopwood provided information and research around a HTTPS - PUT/upload problem we seem to have. No solution found yet. - -Daniel (8 February 2001) -- An interesting discussion is how to specify an empty password without having - curl ask for it interactively? The current implmentation takes an empty - password as a request for a password prompt. However, I still want to - support a blank user field. Thus, today if you enter "-u :" (without user - and password) curl will prompt for the password. Tricky. How would you - specify you want the prompt otherwise? - -- Made the netrc parse result possible to use for other protocols than FTP and - HTTP (such as the upcoming TELNET fixes). - -- The previously mentioned "MSVC++ problems" turned out to be a non-issue. - -- Added a HTTP file upload code example in the docs/examples/ section on - request. - -- Adjusted the FTP response fix slightly. - -Version 7.6.1-pre3 - -Daniel (7 February 2001) -- S. Moonesamy found a flaw in the response reading function for FTP that - could make libcurl not get out of the loop properly when it should, if - libcurl got -1 returned when reading the socket. - -- I found a similar mistake in http.c when using a proxy and reading the - results from the proxy connection. - -Daniel (6 February 2001) -- S. Moonesamy pointed out that the VC makefile in src/ needed the libpath set - for the debug build to work. - -- Daniel Gehriger stepped in to assist with the VC++ stuff Robert Weaver - brought up yesterday. - -Daniel (5 February 2001) -- Jun-ichiro itojun Hagino brought a big patch that brings IPv6-awareness to - a bunch of different areas within libcurl. - -- Robert Weaver told me about the problems the MS VC++ 6.0 compiler has with - the 'static' keyword on a number of libcurl functions. I might need to add a - patch that redefines static when libcurl is compiled with that compiler. - How do I know when VC++ compiles, anyone? - -Daniel (4 February 2001) -- curl_getinfo() was extended with two new options: - CURLINFO_CONTENT_LENGTH_DOWNLOAD and CURLINFO_CONTENT_LENGTH_UPLOAD. They - return the full assumed content length of the transfer in the given - direction. The CURLINFO_CONTENT_LENGTH_DOWNLOAD will be the Content-Length: - size of a HTTP download. Added descriptions to the man page as well. This - was done after discussions with Bob Schader. - -Daniel (3 February 2001) -- Ingo Ralf Blum provided another fix that makes curl build under the more - recent cygwin installations. It seems they've changed the preset defines to - not include WIN32 anymore. - -Version 7.6.1-pre2 - -Daniel (31 January 2001) -- Curl_read() and curl_read() now return a ssize_t for the size, as it had to - be able to return -1. The telnet support crashed due to this and there was a - possibility to weird behavior all over. Linus Nielsen Feltzing helped me - find this. - -- Added a configure.in check for a working getaddrinfo() if IPv6 is requested. - I also made the configure script feature --enable-debug which sets a couple - of compiler options when used. It assumes gcc. - -Daniel (30 January 2001) -- I finally took a stab at the long-term FIXME item I've had on myself, and - now libcurl will properly work when doing a HTTP range-request that follows - a Location:. Previously that would make libcurl fail saying that the server - doesn't seem to support range requests. - -Daniel (29 January 2001) -- I added a test case for the HTTP PUT resume thing (test case 33). - -Version 7.6.1-pre1 - -Daniel (29 January 2001) -- Yet another Content-Range change. Ok now? Bob Schader checks from his end - and it works for him. - -Daniel (27 January 2001) -- So the HTTP PUT resume fix wasn't good. There should appearantly be a - Content-Range header when resuming a PUT. - -- I noticed I broke the download-check that verifies that a resumed HTTP - download is actually resumed. It got broke because my new 'httpreq' field - in the main curl struct. I should get slapped. I added a test case for - this now, so I won't be able to ruin this again without noticing. - -- Added a test case for content-length verifying when downloading HTTP. - -- Made the progress meter title say if the transfer is being transfered. It - makes the output slightly better for resumes. - -- When dealing with Location: and HTTP return codes, libcurl will not attempt - to follow the spirit of RFC2616 better. It means that when POSTing to a - URL that is being following to a second place, the standard will judge on - what to do. All HTTP codes except 303 and 305 will cause curl to make a - second POST operation. 303 will make a GET and 305 is not yet supported. - - I also wrote two test cases for this POST/GET/Location stuff. - -Version 7.6 - -Daniel (26 January 2001) -- Lots of mails back and forth with Bob Schader finally made me add a small - piece of code in the HTTP engine so that HTTP upload resume works. You can - now do an operation like 'curl -T file -C <offset> <URL>' and curl will PUT - the ending part of the file starting at given offet to the specified URL. - -Version 7.6-pre4 - -Daniel (25 January 2001) -- I took hold of Rick Jones' question why we don't use recv() and send() for - reading/writing to the sockets and I've now modified the sread() and - swrite() macros to use them instead. If nothing else, they could be tested - in the next beta-round coming right up. - -- Jeff Morrow found a problem with libcurl's usage of SSL_read() and supplied - his research results in how to fix this. It turns out we have to invoke the - function several times in some cases. The same goes for the SSL_write(). - - I made some rather drastic changes all over libcurl to make all writes and - reads get done on one single place so that this repeated-attempts thing - would only have to be implemented at one point. - -- Rick Jones spotted that the 'total time' counter really didn't measure the - total time very accurate on subsecond levels. - -- Johan Nilsson pointed out the need to more clearly specify that the timeout - value you set for a download is for the *entire* download. There's currently - no option available that sets a timeout for the connection phase only. - -Daniel (24 January 2001) -- Ingo Ralf Blum submitted a series of patches required to get curl to compile - properly with cygwin. - -- Robert Weaver posted a fix for the win32 section of the curl_getenv() code - that corrected a potential memory leak. - -- Added comments in a few files in a sudden attempt to make the sources more - easy to read and understand! - -Daniel (23 January 2001) -- Added simple IPv6 detection in the configure script and made the version - string add 'ipv6' to the enable section in that case. ENABLE_IPV6 will be - set if curl is compiled with IPv6 support enabled. - -- Added a parser for IPv6-style specified IP-addresses in a URL. Thus, when - IPv6 gets enabled soon, we can use URLs like '[0::1]:80'... - -- Made the URL globbing in the client possible to fail silently if there's an - error in the globbing. It makes it almost intuitive, so when you don't - follow the syntax rules, globbing is simply switched off and the raw string - is used instead. - - I still think we'll get problems with IPv6-style IP-addresses when we *want* - globbing on parts of the URL as the initial part of the URL will for sure - seriously confuse the globber. - -Daniel (22 January 2001) -- Björn Stenberg supplied a progress meter patch that makes it look better even - during slow starts. Previously it made some silly assumptions... - -- Added two FTP tests for -Q and -Q - stuff since it was being discussed on - the mailing list. Had to correct the ftpserver.pl too as it bugged slightly. - -Daniel (19 January 2001) -- Made the Location: parsers deal with any-length URLs. Thus I removed the last - code that restricts the length of URLs that curl supports. - -- Added a --globoff test case (#28) and it quickly identified a memory problem - in src/main.c that I took care of. - -Version 7.6-pre3 - -Daniel (17 January 2001) -- Made the two former files lib/download.c and lib/highlevel.c become the new - lib/transfer.c which makes more sense. I also did the rename from Transfer() - to Curl_Transfer() in the other source files that use the transfer function - in the spirit of using Curl_ prefix for library-scoped global symbols. - -Daniel (11 January 2001) -- Added -g/--globoff that switches OFF the URL globbing and thus enables {}[] - letters to be part of the URL. Do note that RFC2396 section 2.4.3 explicitly - mention these letters to be escaped. This was posted as a feature request by - Jorge Gutierrez and as a bug by Terry. - -- Short options to curl that requires parameters can now be specified without - having the option and its parameter space separated. -ofile works as good as - -o file. -m20 is equal to -m 20. Do note that this goes for single-letter - options only, verbose --long-style options still must be separated with - space from their parameters. - -Daniel (8 January 2001) -- Francis Dagenais reported that the SCO compiler still fails when compiling - curl due to that getpass_r() prototype. I've now put it around #ifndef - HAVE_GETPASS_R in an attempt to please the SCO systems. - -- Made some minor corrections to get the client to cleanup properly and I made - the separator work again when getting multiple globbed URLs to stdout. - -- Worked with Loic Dachary to get the make dist and make distcheck work - correctly. The 'maketgz' script is now using the automake generated 'make - dist' when creating release archives. Loic successfully made 'make rpms' - automatically build RPMs! - -Loic Dachary (6 January 2001) -- Automated generation of rpm packages, no need to be root. - -- make distcheck generates a proper distribution (EXTRA_DIST - in all Makefile.am modified to match FILES). - -Daniel (5 January 2001) -- Huge client-side hack: now multiple URLs are supported. Any number of URLs - can be specified on the command line, and they'll all be downloaded. There - must be a corresponding -o or -O for each URL or the data will be written to - stdout. This needs more testing, time to release a 7.6-pre package. - -- The krb4 support was broken in the release. Fixed now. - -- Huge internal symbol rename operation. All non-static but still lib-internal - symbols should now be prefixed with 'Curl_' to prevent collisions with other - libs. All public symbols should be prefixed with 'curl_' and the rest should - be static and thus invisible to the outside world. I updated the INTERNALS - document to say this as well. - -Version 7.5.2 - -Daniel (4 January 2001) -- As Kevin P Roth suggested, I've added text to the man page for every command - line option and what happens when you specify that option more than - once. That hasn't been exactly crystal clear before. - -- Made the configure script possible to run from outside the source-tree. For - odd reasons I can't build curl properly outside though. It has to do with - curl's dependencies on libcurl... - -- Cut off all older (dated 1999 and earlier) CHANGES entries from this file. - The older piece is named CHANGES.0 and is added to the CVS repository in - case anyone would need it. - -- I added another file 'CVS-INFO' to the CVS. It contains information about - files in the CVS that aren't included in release archives and how to build - curl when you get the sources off CVS. - -- Updated CONTRIBUTE and FAQ due to the new license. - -Daniel (3 January 2001) -- Renamed README.libcurl to LIBCURL - -- Changed headers in all sources files to the new dual license concept of - curl: use the MIT/X derivate license *or* MPL. The LEGAL file was updated - accordingly and the MPL 1.1 and MIT/X derivate licenses are now part of the - release archive. -Daniel (30 December 2000) -- Made all FTP commands get sent with the trailing CRLF in one single write() - as splitting them up seems to confuse at least some firewalls (FW-1 being - one major). - -Daniel (19 December 2000) -- Added file desrciptor and FILE handle leak detection to the memdebug system - and thus I found and removed a file descriptor leakage in the ftp parts - that happened when you did PORTed downloads. - -- Added an include <stdio.h> in <curl/curl.h> since it uses FILE *. - -Daniel (12 December 2000) -- Multiple URL downloads with -O was still bugging. Not anymore I think or - hope, or at least I've tried... :-O - -- Francois Petitjean fixed another -O problem - -Version 7.5.1 - -Daniel (11 December 2000) -- Cleaned up a few of the makefiles to use unix-style newlines only. As Kevin - P Roth found out, at least one CVS client behaved wrongly when it found - different newline conventions within the same file. - -- Albert Chin-A-Young corrected the LDFLAGS use in the configure script for - the SSL stuff. - -Daniel (6 December 2000) -- Massimo Squillace correctly described how libcurl could use session ids when - doing SSL connections. - -- James Griffiths found out that curl would crash if the file you specify with - -o is shorter than the URL! This took some hours to fully hunt down, but it - is fixed now. - -Daniel (5 December 2000) -- Jaepil Kim sent us makefiles that build curl using the free windows borland - compiler. The root makefile now accepts 'make borland' to build curl with - that compiler. - -- Stefan Radman pointed out that the test makefiles didn't use the PERL - variable that the configure scripts figure out. Actually, you still need - perl in the path for the test suite to run ok. - -- Rich Gray found numerous portability problems: - * The SCO compiler got an error on the getpass_r() prototype in getpass.h - since the curl one differed from the SCO one - * The HPUX compiler got an error because of how curl did the sigaction - stuff and used a define HPUX doesn't have (or need). - * A few more problems remain to be researched. - -- Paul Harrington experienced a core dump using https. Not much details yet. - -Daniel (4 December 2000) -- Jörn Hartroth fixed a problem with multiple URLs and -o/-O. - -Version 7.5 - -Daniel (1 December 2000) -- Craig Davison gave us his updates on the VC++ makefiles, so now curl should - build fine with the Microsoft compiler on windows too. - -- Fixed the libcurl versioning so that we don't ruin old programs when - releasing new shared library interfaces. - -Daniel (30 November 2000) -- Renamed docs/README.curl to docs/MANUAL to better reflect what the document - actually contains. - -Daniel (29 November 2000) -- I removed a bunch of '#if 0' sections from the code. They only make things - harder to follow. After all, we do have all older versions in the CVS. - -Version 7.5-pre5 - -Daniel (28 November 2000) -- I filled in more error codes in the man page error code list that had been - lagging. - -- James Griffiths mailed me a fine patch that introduces the CURLOPT_MAXREDIRS - libcurl option. When used, it'll prevent location following more than the - set number of times. It is useful to break out of endless redirect-loops. - -Daniel (27 November 2000) -- Added two test cases for file://. - -Daniel (22 November 2000) -- Added the libcurl CURLOPT_FILETIME setopt, when set it tries to get the - modified time of the remote document. This is a special option since it - involves an extra set of commands on FTP servers. (Using the MDTM command - which is not in the RFC959) - - curl_easy_getinfo() got a corresponding CURLINFO_FILETIME to get the time - after a transfer. It'll return a zero if CURLOPT_FILETIME wasn't used or if - the time wasn't possible to get. - - --head/-I used on a FTP server will now present a 'Last-Modified:' header - if curl could get the time of the specified file. - -- Added the option '--cacert [file]' to curl, which allows a specified PEM - file to be used to verify the peer's certificate when doing HTTPS - connections. This has been requested, rather recently by Hulka Bohuslav but - others have asked for it before as well. - -Daniel (21 November 2000) -- Numerous fixes the test suite has brought into the daylight: - - * curl_unescape() could return a too long string - * on ftp transfer failures, there could be memory leaks - * ftp CWD could use bad directory names - * memdebug now uses the mprintf() routines for better portability - * free(NULL) removed when doing resumed transfers - -- Added a bunch of test cases for FTP. - -- General cleanups to make less warnings with gcc -Wall -pedantic. - -- I made the tests/ftpserver.pl work with the most commonly used ftp - operations. PORT, PASV, RETR, STOR, LIST, SIZE, USER, PASS all work now. Now - all I have to do is integrate the ftp server doings in the runtests.pl - script so that ftp tests can be run the same way http tests already run. - -Daniel (20 November 2000) -- Made libcurl capable of dealing with any-length URLs. The former limit of - 4096 bytes was a bit annoying when people wanted to use curl to really make - life tough on a web server. Now, the command line limit is the most annoying - but that can be circumvented by using a config file. - - NOTE: there is still a 4096-byte limit on URLs extracted from Location: - headers. - -- Corrected the spelling of 'resolve' in two error messages. - -- Alexander Kourakos posted a bug report and a patch that corrected it! It - turned out that lynx and wget support lowercase environment variable names - where curl only looked for the uppercase versions. Now curl will use the - lowercase versions if they exist, but if they don't, it'll use the uppercase - versions. - -Daniel (17 November 2000) -- curl_formfree() was added. How come no one missed that one before? I ran the - test suite with the malloc debug enabled and got lots of "nice" warnings on - memory leaks. The most serious one was this. There were also leaks in the - cookie handling, and a few errors when curl failed to connect and similar - things. More tests cases were added to cover up and to verify that these - problems have been removed. - -- Mucho updated config file parser (I'm dead tired of all the bug reports and - weird behaviour I get on the former one). It works slightly differently now, - although I doubt many people will notice the differences. The main - difference being that if you use options that require parameters, they must - both be specified on the same line. With this new parser, you can also - specify long options without '--' and you may separate options and - parameters with : or =. It makes a config file line could look like: - - user-agent = "foobar and something" - - Parameters within quotes may contain spaces. Without quotes, they're - expected to be a single non-space word. - - Had to patch the command line argument parser a little to make this work. - -- Added --url as an option to allow the URL to be specified this way. It makes - way nicer config files. The previous way of specifying URLs in the config - file doesn't work anymore. - -Daniel (15 November 2000) -- Using certain characters in usernames or passwords for HTTP authentication - failed. This was due to the mprintf() that had a silly check for letters, - and if they weren't isprint() they weren't outputed "as-is". This caused - passwords and usernames using '§' (for example) to fail. - -Version 7.4.2 - -Daniel (15 November 2000) -- 'tests/runtests.pl' now sorts the test cases properly when 'all' is used. - -Daniel (14 November 2000) -- I fell over the draft-ietf-ftpext-mlst-12.txt Internet Draft titled - "Extensions to FTP" that contains a defined way how the ftp command SIZE - could be assumed to work. - -- Laurent Papier posted a bug report about using "-C -" and FTP uploading a - file that isn't prsent on the server. The server might then return a 550 and - curl will fail. Should it instead as Laurent Papier suggests, start - uploading from the beginning as a normal upload? - -Daniel (13 November 2000) -- Fixed a crash with the followlocation counter. - -- While writing test cases for the test suite, I discovered an old limitation - that prevented -o and -T to be used at the same time. I removed this - immediately as this has no relevance in the current libcurl. - -- Chris Faherty fixed a free-twice problem in lib/file.c - -- I fixed the perl http server problem in the test suite. - -Version 7.4.2 pre4 - -Daniel (10 November 2000) -- I've (finally) started working on the curl test suite. It is in the new - tests/ directory. It requires sh and perl. There's a TCP server in perl and - most of the other stuff running a pretty simple shell script. - - I've only made four test cases so far, but it proves the system can work. - -- Laurent Papier noticed that curl didn't set TYPE when doing --head checks - for sizes on FTP servers. Some servers seem to return different sizes - depending on whether ASCII or BINARY is used! - -- Laurent Papier detected that if you appended a FTP upload and everything was - already uploaded, curl would hang. - -- Angus Mackay's getpass_r() in lib/getpass.c is now compliant with the - getpass_r() function it seems some systems actually have. - -- Venkataramana Mokkapati detected a bug in the cookie parser and corrected - it. If the cookie was set for the full host name (domain=full.host.com), - the cookie was never sent back because of a faulty length comparison between - the set domain length and the current host name. - -Daniel (9 November 2000) -- Added a configure check for gethostbyname in -lsocket (OS/2 seems to need - it). Added a check for RSAglue/rsaref for the cases where libcrypto is found - but libssl isn't. I haven't verified this fix yet though, as I have no - system that requires those libs to build. - -Version 7.4.2 pre3 - -Daniel (7 November 2000) -- Removed perror() outputs from getpass.c. Angus Mackay also agreed to a - slightly modified license of the getpass.c file as the prototype was changed. - -Daniel (6 November 2000) -- Added possibility to set a password callback to use instead of the built-in. - They're controled with curl_easy_setopt() of course, the tags are - CURLOPT_PASSWDFUNCTION and CURLOPT_PASSWDDATA. - -- Used T. Bharath's thinking and fixed the timers that showed terribly wrong - times when location: headers were followed. - -- Emmanuel Tychon discovered that curl didn't really like user names only in - the URL. I corrected this and I also fixed the since long living problem - with URL encoded user names and passwords in the URLs. They should work now. - -Daniel (2 November 2000) -- When I added --interface, the new error code that was added with it was - inserted in the wrong place and thus all error codes from 35 and upwards got - increased one step. This is now corrected, we're back at the previous - numbers. All new exit codes should be added at the end. - -Daniel (1 November 2000) -- Added a check for signal() in the configure script so that if sigaction() - isn't present, we can use signal() instead. - -- I'm having a license discussion going on privately. The issue is yet again - GPL-licensed programs that have problems with MPL. I am leaning towards - making a kind of dual-license that will solve this once and for all... - -Daniel (31 October 2000) -- Added the packages/ directory. I intend to let this contain some docs and - templates on how to generate custom-format packages for various platforms. - I've now removed the RPM related curl.spec files from the archive root. - -Daniel (30 October 2000) -- T. Bharath brought a set of patches that bring new functionality to - curl_easy_getinfo() and curl_easy_setopt(). Now you can request peer - certificate verification with the *setopt() CURLOPT_SSL_VERIFYPEER option - and then use the CURLOPT_CAINFO to set the certificate to verify the remote - peer against. After an such an operation with a verification request, the - *_getinfo() option CURLINFO_SSL_VERIFYRESULT will return information about - whether the verification succeeded or not. - -Daniel (27 October 2000) -- Georg Horn brought us a splendid patch that solves the long-standing - annoying problem with timeouts that made curl exit with silly exit codes - (which as been commented out lately). This solution is sigaction() based and - of course then only works for unixes (and only those unixes that actually - have the sigaction() function). - -Daniel (26 October 2000) -- Björn Stenberg supplied a patch that fixed the flaw mentioned by Kevin Roth - that made the password get echoed when prompted for interactively. The - getpass() function (now known as my_getpass()) was also fixed to not use any - static buffers. This also means we cannot use the "standard" getpass() - function even for those systems that have it, since it isn't thread-safe. - -- Kevin Roth found out that if you'd write a config file with '-v url', the - url would not be used as "default URL" as documented, although if you wrote - it 'url -v' it worked! This has been corrected now. - -- Kevin Roth's idea of using multiple -d options on the same command line was - just brilliant, and I couldn't really think of any reason why we shouldn't - support it! The append function always append '&' and then the new -d - chunk. This enables constructs like the following: - - curl -d name=daniel -d age=unknown foobarsite.com - -Daniel (24 October 2000) -- I fixed the lib/memdebug.c source so that it compiles on Linux and other - systems. It will be useful one day when someone else but me wants to run the - memory debugging system. - -Daniel (23 October 2000) -- I modified the maketgz and configure scripts, so that the configure script - will fetch the version number from the include/curl/curl.h header files, and - then the maketgz doesn't have to rebuild the configure script when I build - release-archives. - -- Björn Stenberg and Linus Nielsen correctly pointed out that curl was silly - enough to not allow @-letters in passwords when they were specified with the - -u or -U flags (CURLOPT_USERPWD and CURLOPT_PROXYUSERPWD). This also - suggests that curl probably should url-decode the password piece of an URL - so that you could pass an encoded @-letter there... - -Daniel (20 October 2000) -- Yet another http server barfed on curl's request that include the port - number in the Host: header always. I now only include the port number if it - isn't the default (80 for HTTP, 443 for HTTPS). www.perl.com turned out to - run one of those nasty servers. - -- The PHP4 module for curl had problems with referer that seems to have been - corrected just yesterday. (Sterling Hughes of the PHP team confirmed this) - -Daniel (17 October 2000) -- Vladimir Oblomov reported that the -Y and -y options didn't work. They - didn't work for me either. This once again proves we should have that test - suite... - -- I finally changed the error message libcurl returns if you try a https:// - URL when the library wasn't build with SSL enabled. It will now return this - error: - "libcurl was built with SSL disabled, https: not supported!" - - I really hope it will make it a bit clearer to users where the actual - problem lies. - -Version 7.4.1 - -Daniel (16 October 2000) -- I forgot to remove some of the malloc debug defines from the makefiles in - the release archive (of course). - -Version 7.4 - -Daniel (16 October 2000) -- The buffer overflow mentioned below was posted to bugtraq on Friday 13th. - -Daniel (12 October 2000) -- Colin Robert Phipps elegantly corrected a buffer overflow. It could be used - by an evil ftp server to crash curl. I took the opportunity of replacing a - few other sprintf()s into snprintf()s as well. - -Daniel (11 October 2000) -- Found some more memory leaks. This new simple memory debugger has turned out - really useful! - -Version 7.4 pre6 - -Daniel (9 October 2000) -- Florian Koenig pointed out that the bool typedef in the curl/curl.h include - file was breaking PHP 4.0.3 compiling. The bool typedef is not used in the - public interface and was wrongly inserted in that header file. - -- Jörg Hartroth corrected a minor memory leak in the src/urlglob.c stuff. It - didn't harm anyone since the memory is free()ed on exit anyway. - -- Corrected the src/main.c. We use the _MPRINTF_REPLACE #define to use our - libcurl-printf() functions. This gives us snprintf() et al on all - platforms. I converted the allocated useragent string to one that uses a - local buffer. - -- I've set an #if 0 section around the Content-Transfer-Encoding header - generated in lib/formdata.c. This will hopefully make curl do more - PHP-friendly multi-part posts. - -Version 7.4 pre5 - -Daniel (9 October 2000) -- Nico Baggus found out that curl's ability to force a ASCII download when - using FTP was no longer working! I corrected this. This problem was probably - introduced when I redesigned libcurl for version 7. - -- Georg Horn provided a source example that proved a memory leak in libcurl. - I added simple memory debugging facilities and now we can make libcurl log - all memory fiddling functions. An additional perl script is used to analyze - the output logfile and to match malloc()s with free()s etc. The memory leak - Georg found turned out to be the main cookie struct that cookie_cleanup() - didn't free! The perl script is named memanalyze.pl and it is available in - the CVS respository, not in the release archive. - -Daniel (8 October 2000) -- Georg Horn found a GetHost() problem. It turned out it never assigned the - pointer in the third argument properly! This could make a crash, or at best - a memory leak! - -Version 7.4 pre4 - -Daniel (6 October 2000) -- Is the -F post following the RFC 1867 spec? We had this dicussion on the - mailing list since it appears curl can't post -F form posts to a PHP - receiver... I've been in touch with the PHP developers about this. - -- Domenico Andreoli found out that the long option '--proxy' wasn't working - anymore! The option parser got confused when I added the --proxytunnel for - 7.3. This was indeed a very old flaw that hasn't turned up until now... - -- Jörn Hartroth provided patches, updated makefiles and two new files for DLL - stuff on win32. He also pointed out that lib source files were compiled with - -I../src which isn't only wrong but plain stupid! - -- Troels Walsted Hansen fixed a problem with HTTP resume. Curl previously used - a local variable badly, that could lead to crashes. - -Version 7.4 pre3 - -Daniel (4 October 2000) -- More docs written. The curl_easy_getinfo.3 man page is now pretty accurate, - as is the -w section in curl.1. I added two options to enable the user to - get information about the received headers' size and the size of the HTTP - request. T. Bharath requested them. - -Daniel (3 October 2000) -- Corrected a sever free() before use in the new add_buffer_send()! ;-) - -Version 7.4 pre2 - -Daniel (3 October 2000) -- Jason S. Priebe sent me patches that changed the way curl issues HTTP - requests. The entire request is now issued in one single shot. It didn't do - this previously, and it has turned out that since the common browsers do it - this way, some sites have turned out to work with browsers but not with - curl! Although this is not a client-side problem, we want to be able to - fully emulate browsers, and thus we have now adjusted the networking layer - to slightly more appear as a browser. I adjusted Jason's patch, the faults - are probably mine. - -Daniel (2 October 2000) -- Anyone who ever uploaded data with curl on a slow link has noticed that the - progess meter is updated very infrequently. That is due to the large buffer - size curl is using. It reads 50Kb and sends it, updates the progress meter - and loops. 50Kb is very much on a slow link, although it is pretty neat to - use on a fast one. - - I've now made an adjustment that makes curl use a 2Kb buffer for uploads to - start with. If curl's average upload speed is faster than buffer size bytes - per second, curl will increase the used buffer size up to max 50Kb. It - should make the progress meter work better. - -Version 7.4 pre1 - -Daniel (29 September 2000) -- Ripped out the -w stuff from the library and put in the curl tool. It gets - all the relevant info from the library using the new curl_easy_getinfo() - function. - -- brad at openbsd.org mailed me a patch that corrected my kerberos mistake and - removed a compiler warning from hostip.c that OpenBSD people get. - -Daniel (28 September 2000) -- Of course (I should probably get punished somehow) I didn't properly correct - the #include lines for the base64 stuff in the kerberos sources in the just - released 7.3 package. They still include the *_krb.h files! Now, the error - is sooo very easy to spot and fix so I won't bother with a quick bug fix - release. I'll post a patch whenever one is needed instead. It'll be - available in the CVS in a few minutes anyway. - -Version 7.3 - -Daniel (28 September 2000) -- Removed the base64_krb.[ch] files. They've now replaced the former - base64.[ch] files. - -Daniel (26 September 2000) -- Updated some docs. - -- I changed the OpenSSL fix to work with older versions as well. The posted - patch was only working with 0.9.6 and no older ones. - -Version 7.3-pre8 - -Daniel (25 September 2000) -- Erdmut Pfeifer informed us that curl didn't build with OpenSSL 0.9.6 and - showed us what needed to get patched in order to make it build properly - again. - -- Dirk Kruschewski found a bug in the cookie parser. I made an alternative - approach to the solution Dirk himself suggested. The bug made a cookie - header that didn't end with a trailing semicolon to not get parsed. - -- I've marked -c and -t deprecated now. If you use any of them, curl will tell - you to use "-C -" or "-T -" instead. I don't think occupying two letters for - nearly identical functions is good use. Also, -T - kind of follows the curl - tradition of using - for stdin where a file name is expected. - -Daniel (23 September 2000) -- Martin Hedenfalk provided the patch that finally made the krb4 ftp upload - work! - -Daniel (21 September 2000) -- The kerberos code is not quite thread-safe yet. There are a few more globals - that need to be take care of. Let's get the upload working first! - -Daniel (20 September 2000) -- Richard Prescott solved another name lookup buffer size problem. I took this - opportunity to rewrite the GetHost() function. With these large buffer - sizes, I think keeping them as local arrays quickly turn ugly. I now use - malloc() to get the buffer memory. Thanks to this, I now can realloc() to a - large buffer in case of demand (errno == ERANGE) in case a solution like - that would become necessary. I still want to avoid that kind of nastiness. - -- Tried to compile and run curl on Linux for alpha and FreeBSD for alpha. Went - as smooth as it could. - -- Added a docs/examples directory with two tiny example sources that show how - to use libcurl. I hope users will supply me with more useful examples - further on. - -- Applied a patch by Jörn Hartroth to no longer use the word 'inteface' in the - config struct in the src/main.c file since certain compilers have that word - "reservered". I figure that is some kind of C++ decease. - -- Updated the curl.1 man page with --interface and --krb4. - -- Modified the base64Encode() function to work like the kerberos one, so that - I could remove the use of that. There is no need for *two* base64 encoding - functions! ;-) - -Version 7.3pre5 - -Daniel (19 September 2000) -- The kerberos4-layer source code that is much "influenced" by the original - krb4 source code, through yafc into curl, was using quite a lot of global - variables. libcurl can't work properly with globals like that why I had to - clean up almost every function in the new security.c to make them use - connection specific variables instead of the globals. I just hope I didn't - destroy anything now... :-) configure updated, version string now reflects - krb4 built-in. It almost works now. Only uploads are still being naughty. - -Version 7.3pre3 - -Daniel (18 September 2000) -- Martin Hedenfalk supplied a major patch that introduces krb4-ftp support to - curl. Martin is the primary author of the ftp client named yafc and he did - not hesitate to help us implement this when I asked him. Many and sincere - thanks to a splendid effort. It didn't even take many hours! - -- Stephen Kick supplied a big patch that introduces the --interface flag to - the curl tool and CURLOPT_INTERFACE for libcurl. It allows you to specify an - outgoing interface to use for your request. This may not work on all - platforms. This needs testing. - -- Richard Prescott noticed that curl on Tru64 unix could core dumped if the - name didn't resolve properly. This was due to the GetHost() function not - returning an error even though it failed on some platforms! - -Daniel (15 September 2000) -- Updated all sorts of documents in regards to the new proxytunnel support. - -Version 7.3pre2 - -Daniel (15 September 2000) -- Kai-Uwe Rommel pointed out a problem in the httpproxytunnel stuff for ftp. - Adjusted it. Added better info message when setting up the tunnel and the - pasv message when doing the second connect. - -Version 7.3pre1 - -Daniel (15 September 2000) -- libcurl now allows "httpproxytunnel" to an arbitrary host and port name. The - second connection on ftp needed that. - -- TheArtOfHTTPScripting was corrected all over. I both type and spell really - bad at times! - -Daniel (14 September 2000) -- -p/--proxytunnel was added to 'curl'. It uses the new - CURLOPT_HTTPPROXYTUNNEL libcurl option that allows "any" protocol to tunnel - through the specified http proxy. At the moment, this should work with ftp. - -Daniel (13 September 2000) -- Jochen Schaeuble found that file:// didn't work as expected. Corrected this - and mailed the patch to the mailing list. - -Daniel (7 September 2000) -- I changed the #define T() in curl.h since it turned out it wasn't really - a good symbol to use (when you compiled PHP with curl as a module, that - define collided with some IMAP define or something). This was posted to the - PHP bug tracker. - -- I added extern "C" stuff in two header files to better allow libcurl usage - in C++ sorces. Discussions on the libcurl list with Danny Horswell lead to - this. - -Version 7.2.1 - -Daniel (31 August 2000) -- Albert Chin-A-Young fixed the configure script *again* and now it seems to - detect Linux name resolving properly! (heard that before?) - -- Troels Walsted Hansen pointed out that downloading a file containing the - letter '+' from an ftp server didn't work. It did work from HTTP though and - the reason was my lame URL decoder. - -- I happened to notice that -I didn't at all work on ftp anymore. I corrected - that. - -Version 7.2 - -Daniel (30 August 2000) -- Understanding AIX is a hard task. I believe I'll never figure out why they - solve things so differently from the other unixes. Now, I'm left with the - AIX 4.3 run-time warnings about duplicate symbols that according to this - article (http://www.geocrawler.com/archives/3/405/1999/9/0/2593428/) is a - libtool flaw. I tried the mentioned patch, although that stops the linking - completely. - - So, if I select to ignore the ld warnings there are compiler warnings that - fill the screen pretty bad when curl compiles. It turns out that if I want - to '#include <arpa/inet.h>', I can get tid of the warnings by include the - following three include files before that one: - - #include <net/if_dl.h> - #include <sys/mbuf.h> - #include <netinet/if_ether.h> - - Now, is it really sane to add those include files before arpa/inet.h in all - the source files that include it? - - Thanks to Albert Chin-A-Young at thewrittenword.com who gave me the AIX - login to try everything on. - -Daniel (24 August 2000) -- Jan Schmidt supplied us a new VC6 makefile for Windows as the previous one - was not up to date but lacked several object files. - -- More work on the naming. - -- Albert Chin-A-Young provided a configure-check for large file support, as - some systems seem to need that for them to work. Had to change the position - for the config.h include file in every .c file in the libcurl dir... - -- As suggested on the mailing list (by Troy Engel), I did use a --data-binary - option instead of the messy way I've left described below. It seems to - work. The libcurl fix remained the same as yesterday. - -Daniel (23 August 2000) -- Back on the -d stripping newlines thing. The 'plain post' thing was added - when I had no thought of that one could actually post binary data with - it. Now, I have to add this functionality in a graceful manner and I think - I've managed to come up with a way: '-d @file;binary' will thus post the - file binary, exactly as its contents are. It is implemented with a new - *setopt() option (CURLOPT_POSTFIELDSIZE) to set the postfield size, since - libcurl can't strlen() the data in these cases. - -- Albert Chin-A-Young made some very serious efforts and all the name - resolving problems seem to have been sorted out now on all the platforms - that previously showed them. I'll make another release now anyday because of - this. - -- The FAQ was much enhanced when it comes to the licensing issues thanks to - Bjorn Reese. - -Daniel (21 August 2000) -- Rick Welykochy pointed out a problem when you use -d to post and you want to - keep the newlines, as curl strips them off as a bonus before posting... - This needs to be addressed. - -Version 7.1.1 - -Daniel (21 August 2000) -- Got more people involved in the gethostbyname_r() mess. Caolan McNamara sent - me configure-code that turned out to be very similar to my existing tests - which only make me more sure I'm on the right path. I changed the order of - the tests slightly, as it seems that some compilers don't yell error if a - function is used with too many parameters. Thus, the first tested function - will seem ok... Let's hope more compilers think of too-few parameters as bad - manners, as we're now trying the functions in that order; fewer first. I - should also add that Lars Hecking mailed me and volunteered to run tests on - a few odd systems. Coalan is keeping his work over at - http://www.csn.ul.ie/~caolan/publink/gethostbyname_r/. Might be handy in the - future as well. - -Daniel (18 August 2000) -- I noticed I hadn't increased the name lookup buffer in lib/ftp.c. I don't - think this is the reason for the continued trouble though. - -Daniel (17 August 2000) -- Fred Noz corrected my stupid mistakes in the gethostbyname_r() fluff. It - should affect some AIX, Digital Unix and HPUX 10 systems. - -Daniel (15 August 2000) -- Mathieu Legare compiled and build 7.1 without errors on both AIX 4.2 as well - as AIX 4.3. Now why did problems occur before? - -- Fred Noz reported a -w/--write-out bug that caused it to malfunction when - used combined with multiple URL retrievales. All but the first display got - screwed up! - -Daniel (11 August 2000) -- Jason Priebe and an anonymous friend found some host names the Linux version - of curl could not resolve. It turned out the buffer used to retrieve that - information was too small. Fixed. One could argue about the usefulness of - not having the slightest trace of a man page for gethostbyname_r() on my - Linux Redhat installation... - -Daniel (10 August 2000) -- Balaji S Rao was first in line to note the missing possibility to replace - the Content-Type: and Content-Length: headers when doing -d posts. I added - the possibility just now. It seems some people wants to do standard posts - using custom Content-Types. - -Daniel (8 August 2000) -- Mike Dowell correctly discovered that curl did not approve of URLs with no - user name but password. As in 'http://:foo@haxx.se'. I corrected this. - -Version 7.1 - -Daniel (7 August 2000) -- My AIX 4 fix does not work. I need help from a AIX 4 hacker. - -- I added my new document in the docs directory. It is aimed to become a sort - of tutorial on how to do HTTP scripting with curl. - -Daniel (4 August 2000) -- Working with Rich Gray on compiling curl for lots of different platforms. - My fix for AIX 3.2 was not good enough and was slightly changed, I had to - move an include file before another, as is now described in the source. - - AIX 4.2 (4.X?) has different gethostbyname_r() and gethostbyaddr_r() - functions that the configure script didn't check for and thus the compile - broke with an error. I have now changed the gethostbyname_r() check in the - configure file to support all three versions of both these functions. My - implementation that uses the AIX-style is though not yet verified and I may - get problems to fix it if it turns out to bug since I don't have access to - any system using that. - - For problems like that, I made the configure script allow --disable-thread - to completely switch off the check for threadsafe versions of a few - functions and thus go with the "good old versions" that tend to work - although will break thread-safeness for libcurl. Most people won't use - libcurl for other things than curl though, and curl doesn't need a - thread-safe lib. - -- Working on my big tutorial about HTTP scripting with curl. - -Daniel (1 August 2000) -- Rich Gray spotted a problem in src/setup.h caused by a #define strequal() - that was just a left-over from passed times. The strequal() is now a true - function supplied by libcurl for a portable case insensitive string - comparison. I added the prototypes in include/curl.h and removed the - now obsolete #define. - -- Igor Khristophorov made a fix to allow resumed download from Sun's - JavaWebServer/1.1.1. It seems that their server sends bad Content-Range - headers. - -- The makefiles forced a static library build, which is bad since we now use - libtool and thus have excellent shared library support! Albert Chin-A-Young - found out. - -Version 7.0.11beta - -Daniel (1 August 2000) -- Albert Chin-A-Young pointed out that 'make install' did not properly create - the header include directory, why it failed to install the header files as - it should. Automake isn't really equipped to deal with subdirectories - without Makefiles in any nice way. I had to run ahead and add Makefiles in - both include and include/curl before I managed to create a top-level - makefile that succeeds in install everything properly! - -- Ok, no more "features" added now. Let's just verify that there's no major - flaws added now. - -Daniel (31 July 2000) -- Both Jeff Schasny and Ketil Froyn asked me how to tell curl not to send one - of those internally generated headers. They didn't settle with the blank - ones you could tell curl to use. I rewrote the header-replace stuff a - little. Now, if you replace an internal header with your own and that new - one is a blank header you will only remove the internal one and not get any - blank. I couldn't figure out any case when you want that blank header. - -Daniel (29 July 2000) -- It struck me that the lib used localtime() which is not thread-safe, so now - I use localtime_r() in the systems that has it. - -- I went through this entire document and removed all email addresses and left - names only. I've really made an effort to always note who brought be bug - reports or fixes, but more and more people ask me to remove the email - addresses since they become victims for spams this way. Gordon Beaton got me - working on this. - -Daniel (27 July 2000) -- Jörn Hartroth found out that when you specified a HTTP proxy in an - environment variable and used -L, curl failed in the second fetch. I - corrected this problem and posted a patch to the list. No need for an extra - beta release just for this. - -Version 7.0.10beta - -Daniel (27 July 2000) -- So, libtool replaced two of my files with symbolic links and I forgot to add - the two new libtool files to the release archive (and they were added as - symlinks as well!) This of course lead to that the configure script failed - on 7.0.9... - -Version 7.0.9beta - -Daniel (25 July 2000) -- Kristian Köhntopp <kris at koehntopp.de> brought a fix that makes libcurl - libtoolified, just as we've wanted for a while now. He also made the - recently added man pages get installed properly on 'make install' and some - other nice cleanups. - -- In a discussion with Eetu Ojanen it struck me that if we use curl to get a - page using a password, and that page then sends a Location: to another - server that curl follows, curl will send the user name and password to that - server as well. - - Now, I'll never be able to make curl do Location: following all that perfect - and you're all sooner or later required to write a script to do several - fetches when you're doing advanced stuff, but now I've modified curl to at - least *only* send the user name and password to the original server. Which - means that if get a page from server A with a password, that forwards curl - to server B, curl won't use the password there. If server B then forwards - curl back to server A again, the password will be used again. - - This is not a perfect implementation, as in a browser case it would only use - the password if the left-prefix of the first path is the same. I just think - that this fix prevents a somewhat lurky "security hole". - - As a side-note in this subject: HTTP passwords are sent in cleartext and - will never be considered to be safe or secure. Use HTTPS for that. - -- As discussed on the mailing list, I converted the FTP response reading - function into using select() which then allows timeouts (even under win32!) - if the command-reply session gets too slow or dies completely. I made a - default timeout on 3600 seconds unless anything else is specified, since I - don't think anyone wants to wait more than that for a single character to - get received... - -- Torsten Foertsch <torsten.foertsch at gmx.net> brought a set of fixes for - the rfc1867 form posts. He introduced 'name=<file' which brings a means to - suuply very large text chunks read from the given file name. It differs from - 'name=@file' in the way that this latter thing is marked in the uploaded - contents as a file upload, while the first is just text (as in a input or - textarea field). Torsten also corrected a bug that would happen if you used - %s or similar in a -F file name. - -- As discovered by Nico Baggus <Nico.Baggus at mail.ing.nl>, when transferring - files to/from FTP using type ASCII curl should not expect the transfer to be - the exact size reported by the server as the file size. Since ASCII may very - well mean that the content is translated while transfered, the final size - may very well differ. Therefor, curl now ignores the file size when doing - ASCII transfers in FTP. - -Daniel (24 July 2000) -- Added CURLOPT_PROXYPORT to the curl_easy_setopt() call to allow the proxy - port number to be set separately from the proxy host name. - -- Andrew <andrew at ugh.net.au> pointed out a netrc manual bug. - -- The FTP transfer code now accepts a 250-code as well as the previously - accepted 226, after a successful file transfer. Mohan <mnair at - evergreen-funds.com> pointed this out. - -- The check for *both* nsl and socket was never added in the v7 configure.in - when I moved the main branch. I re-added that check to configure.in. This was - discovered by Rich Gray. - -- Howard, Blaise <Blaise.Howard at factiva.com> pointed out a missing free() in - curl_disconnect() which of course meant libcurl ate memory. - -- Brian E. Gallew noted that the HTTP 'Host:' header curl sent did not - properly include the port number if non-default ports were used. This should - now have been fixed. - -- HTTP connect errors now return errors earlier. This was most notably causing - problems when the HTTPS certificate had problems and later caused a crash. - Many thanks to Gregory Nicholls <gnicholls at level8.com> for discovering - and suggesting a fix... - -Daniel (21 June 2000) -- After a "bug report" I received where the user was using both -F and -I in a - HTTP request (it severly confused the library I should add), I added some - checks to src/main.c that prevents setting more than one HTTP request - command, no matter what the user wants! ;-) - -Version 7.0.8beta - -Daniel (20 June 2000) -- I did a major replace in many files to use the new curl domain haxx.se - instead of the previous one. - -- As Eetu Ojanen suggested, I finally took the step and now libcurl no longer - makes a POST after it has followed a location. When the initial POST has - been done, it'll turned into a GET for the further requests. This is only - interesting when using -L/--location *and* doing a POST at the same time. - - While messing with this, I added another weird feature I call 'auto - referer'. If you append ';auto' to the right of a given referer string (or - only use that string as referer), libcurl will automatically set the - previoud URL as refered when it follows a Location: and gets a succeeding - document. - -- My hero Rich Gray found the very obscure FTP bug that happened to him only - when passing through a particular firewall and using the PORT command. It - turned out that PORT was the only command in the lib/ftp.c source that - didn't send a proper \r\n sequence but instead used the faulty \n which as - it seemed is supported by most major ftp servers... :-O - -Version 7.0.7beta - -Daniel (16 June 2000) -- I had avoided this long enough now, so I moved the alternative progress bar - stuff from the lib and added it to the client code. This is now using the - recently added progress callback and it seems to work pretty much like - before. Since it is only one progress bar and you and download and upload at - the same time, this bar shows the combined progress of both directions. This - code was just ported from the old place to this, Lars is still our saviour! - ;-) This also made the documentation more accurate since I never removed - this function from any docs! Although I now removed the CURLOPT_PROGRESSMODE - from the library since the lib has only one internal progress meter and it - will never get another. It is although likely that the internal one also - will be moved to the client code in the future (when I have other means of - getting the writeout data and move that too to the client). - -- I took the opportunity to verify that standard progress meter works and I - found out it didn't get inited properly. Grrr. I corrected that as well. - -Daniel (15 June 2000) -- I thought I'd better verify that the -F option still works in v7 and of - course it didn't... :-/ Anyway, I had the problems I could discover - corrected. About one month of beta testing and not a single person has used - this feature with v7? - -- Björn correctly pointed out that the --progress-bar still doesn't work in - v7. Hm. - -Daniel (14 June 2000) -- Tim Tassonis discovered that curl 7 didn't handle normal http POST as it - should. I corrected this. - -Version 7.0.6beta - -Daniel (14 June 2000) -- Björn Stenberg pointed out several problems (related to win32 compiling): - lib/strequal.c had a bad #ifdef for one of the string comparisons (win32) - src/main.c had several minor problems - lib/makefile.m32 had getpass.[co] twice - src/config-win32.h lacked the HAVE_FCNTL_H define - both config-win32.h files now only set the HAVE_UNISTD_H define if the - define MINGW32 is set, and I modified src/makefile.m32 and lib/makefile.m32 - to set it. - -Version 7.0.5beta - -Daniel (14 June 2000) -- Applied Luong Dinh Dung's comments about a few win32 compile problems. - -- Applied Björn Stenberg's suggested fix that turns the win32 stdout to - binary. It won't do it if the -B / --use-ascii option is used. That option - is now an extended version of the previous -B /--ftp--ascii. The flag was - already in use be the ldap as well so the new name fits pretty good. The - libcyrl CURLOPT_TRANSFERTEXT was also introduced as an alias to the now - obsolete CURLOPT_FTPASCII. Can't verify this fix myself as I have no win32 - compiler around. - -Daniel (13 June 2000) -- Luong Dinh Dung <dung at sch.bme.hu> found a problem in curl_easy_cleanup() - since it free()ed the main curl struct *twice*. This is now corrected. - -Daniel (9 June 2000) -- Updated the RESOURCES file, added a README.win32 file. - -Daniel (8 June 2000) -- So I finally added the progress callback to the *setopt() options and it - should work now. I don't have the energy to write any test program for it - right now. -- Made the callback function typedefs public in curl/curl.h for comfort. Just - in case anyone wanna fiddle with such pointers. -- Updated the curl_easy_setopt() man page accordingly. - -Version 7.0.4beta - -Daniel (2 June 2000) -- I noticed that when doing Location: following, we lost custom headers in all - but the first request. -- Removed the 'HttpPost' struct and moved the header stuff to the more generic - curl_slist. -- Added some better slist-cleanups in src/main.c - -Version 7.0.3beta - -Daniel (31 May 2000) -- So I discovered that I released the 7.0.2beta without it being able to - compile under Linux. gethostbyname_r() and gethostbyaddr_r() turned out to - feature a different amount of arguments on different systems so I had to add - a configure check for this and adjust the code slightly. - -Version 7.0.2beta - -Daniel (29 May 2000) -- Corrected the bits.* assignments when using CURLOPT options that only - toggles one of those bits. - -- Applied the huge patches from David LeBlanc <dleblanc at qnx.com> that add - usage of the gethostbyname_r() and similar functions in case they're around, - since that make libcurl much better threadsafe in many systems (such as - solaris). I added the checks for these functions to the configure script. - - I can't explain why, but the inet_ntoa_r() function did not appear in my - Solaris include files, I had to add my own include file for this for now. - -Daniel (22 May 2000) -- Jörn Hartroth brought me fixes to make the win32 version compile properly as - well as a rename of the 'interface' field in the urldata struct, as it seems - to be reserved in some gcc versions! - -- Rich Gray struck back with yet some portability reports. Data General DG/UX - needed a little fix in lib/ldap.c since it doesn't have RTLD_GLOBAL defined. - More fixes are expected as a result of Richies very helpful work. - -Version 7.0.1beta - -Daniel (21 May 2000) -- Updated lots of #defines, enums and variable type names in the library. No - more weird URG or URLTAG prefixes. All types and names should be curl- - prefixed to avoid name space clashes. The FLAGS-parameter to the former - curl_urlget() has been converted into a bunch of flags to use in separate - setopt calls. I'm still focusing on the easy-interface, as the curl tool is - now using that. - -- Bjorn Reese has provided me with an asynchronous name resolver that I plan - to use in upcoming versions of curl to be able to gracefully timeout name - lookups. - -Version 7.0beta - -Daniel (18 May 2000) -- Introduced LIBCURL_VERSION_NUM to the curl.h include file to better allow - source codes to be dependent on the lib version. This define is now set to - a dexadecimal number, with 8 bits each for major number, minor number and - patch number. In other words, version 1.2.3 would make it 0x010203. It also - makes a larger number a newer version. - -Daniel (17 May 2000) -- Martin Kammerhofer correctly pointed out several flaws in the FTP range - option. I corrected them. -- Removed the win32 winsock init crap from the lib to the src/main.c file - in the application instead. They can't be in the lib, especially not for - multithreaded purposes. - -Daniel (16 May 2000) -- Rewrote the src/main.c source to use the new easy-interface to libcurl 7. - There is still more work to do, but the first step is now taken. - <curl/easy.h> is the include file to use. - -Daniel (14 May 2000) -- FTP URLs are now treated slightly different, more according to RFC 1738. -- FTP sessions are now performed differently, with CWD commands to change - directory instead of RETR/STOR/LIST with the full path. Discussions with - Rich Gray made me notice these problems. -- Janne Johansson discovered and corrected a buffer overflow in the - src/usrglob.c file. -- I had to add a lib/strequal.c file for doing case insensitive string - compares on all platforms. - -Daniel (8 May 2000): -- Been working lots on the new lib. -- Together with Rich Gray, I've tried to adjust the configure script to work - better on the NCR MP-RAS Unix. - -Daniel (2 May 2000): -- Albert Chin-A-Young pointed out that I had a few too many instructions in - configure.in that didn't do any good. - -Daniel (24 April 2000): -- Added a new paragraph to the FAQ about what to do when configure can't - find OpenSSL even though it is installed. Supplied by Bob Allison - -Daniel (12 April 2000): -- Started messing around big-time to convert the old library interface to a - better one... - -Daniel (8 April 2000): -- Made the progress bar look better for file sizes between 9999 kilobytes - and 100 megabytes. They're now displayed XX.XM. -- I also noticed that ftp fetches through HTTP proxies didn't add the user - agent string. It does now. -- Habibie <habibie at MailandNews.com> supplied a pretty good way to build RPMs - on a Linux machine. It still a) requires me to be root to do it, b) leaves - the rpm packages laying at some odd place on my disk c) doesn't work to - build the ssl version of curl since I didn't install openssl from an rpm - package so now the rpm crap thinks I don't have openssl and refuses to build - a package that depends on ssl... Did I mention I don't get along with RPM? -- Once again I received a bug report about autoconf not setting -L prior to -l - on the command line when checking for libs. In this case it made the native - cc compiler on Solaris 7 to fail the OpenSSL check. This has previously been - reported to cause problems on HP-UX and is a known flaw in autoconf 2.13. It - is a pity there's no newer release around... - -Daniel (4 April 2000): -- Marco G. Salvagno supplied me with two fixes that - appearantly makes the OS/2 port work better with multiple URLs. - -Daniel (2 April 2000): -- Another Location: fix. This time, when curl connected to a port and then - followed a location with an absolute URL to another port, it misbehaved. - -Daniel (27 March 2000): -- H. Daphne Luong pointed out that curl was wrongly - messing up the proxy string when fetching a document through a http proxy, - which screwed up multiple fetches such as in location: followings. - -Daniel (23 March 2000): -- Marco G. Salvagno corrected my badly applied patch he - actually already told me about! - -- H. Daphne Luong brought me a fix that now makes curl - ignore select() errors in the download if errno is EINTR, which turns out to - happen every now and then when using libcurl multi-threaded... - -Daniel (22 March 2000): -- Wham Bang supplied a couple of win32 fixes. HAVE_UNAME - was accidentally #defined in config-win32.h, which it shouldn't have been. - The HAVE_UNISTD_H is not defined when compiling with the Makefile.vc6 - makefile for MS VC++. - -Daniel (21 March 2000): -- I removed the AC_PROG_INSTALL macro from configure.in, since it appears that - one of the AM_* macros searches for a BSD compatible install already. Janne - Johansson made me aware of this. - -Version 6.5.2 - -Daniel (21 March 2000): -- Paul Harrington quickly pointed out to me that 6.5.1 - crashes hard. I upload 6.5.2 now as quickly as possible! The problem was - the -D adjustments in src/main.c. - -Version 6.5.1 - -Daniel (20 March 2000): -- An anonymous post on sourceforge correctly pointed out a possible buffer - overflow in the curl_unescape() function for URL conversions. The main - problem with this bug is that the ftp download uses that function and this - single- byte overflow could lead to very odd bugs (as one reported by Janne - Johansson). - -Daniel (19 March 2000): -- Marco G. Salvagno supplied me with a series of patches - that now allows curl to get compiled on OS/2. It even includes a section in - the INSTALL file. Very nice job! - -Daniel (17 March 2000): -- Wham Bang supplied a patch for the lib/Makefile.vc6 - file. We still need some fixes for the config-win32.h since it appears that - VC++ and mingw32 have different opinions about (at least) unistd.h's - existence. - -Daniel (15 March 2000): -- I modified the -D/--dump-header workings so that it doesn't write anything - to the file until it needs to. This way, you can actually use -b and -D - on the same file if you want repeated invokes to store and read the cookies - in that one single file. - -- Poked around in lots of texts. Added the BUGS file for bug reporting stuff. - Added the classic HTTP POST question to the FAQ, removed some #ifdef WIN32 - stuff from the sources (they're covered by the config-win32.h now). - -- Pascal Gaudette fixed a missing ldap.c problem in the - Makefile.vc6 file. He also addressed a problem in src/config-win32.h. - -Daniel (14 March 2000): -- Paul Harrington pointed out that the 'http_code' variable in the -w output - was never written. I fixed it now. - -- Janne Johansson reported the complaints that OpenBSD does - when getdate.c #includes malloc.h. It claims stdlib.h should be included - instead. I added #ifdef HAVE_MALLOC_H code in getdate.y and two checks in - the configure.in for malloc.h and stdlib.h. - -Version 6.5 - -Daniel (13 March 2000): -- <curl at spam.wolvesbane.net> pointed out that the way curl sent cookies in a - single line wasn't enjoyed by IIS4.0 servers. In my view, that is not what - the standards say, but I added a white space between the name/value pairs to - perhaps make them work better. - -- Added the perl check back in the configure.in again since the mkhelp.pl - script needs it! - -- Made some beautifications in the curl man page. - -Daniel (3 March 2000): -- Jörn helped me update the config-win32.h files with HAVE_SETVBUF and - HAVE_STRDUP. - -Daniel (3 March 2000): -- Uploaded the 6.5pre2 package. - -Daniel (2 March 2000): -- Removed the perl-programs from the distribution, they never made many people - happy and I'll still keep them available on the web. - -- Added the -w and -N stuff to the man page. Documented the new progress meter - display in README.curl. - -- Jörn Hartroth, Chris <cbayliss at csc.come> and Ulf - Möller from the openssl development team helped bringing me the details for - fixing an OpenSSL usage flaw. It became apparent when they released openssl - 0.9.5 since that barfed on curl's bad behavior (not seeding a random number - thing). - -- Yet another option: -N/--no-buffer disables buffering in the output stream. - Probably most useful for very slow transfers when you really want to get - every byte curl receives within some preferred time. Andrew <tmr at gci.net> - suggested this. - -- Damien Adant mailed me his fixes for making curl compile on Ultrix. - -Daniel (24 February 2000): -- Applied Jörn Hartroth's fixes for config-win32.h and lib/Makefile.w32. - - I should also make a note here, if nothing else to myself, that when using - the %-syntax for variables in DOS command prompts, you must use two %- - letters for each one since that is an escape letter there! Maybe I should - use another letter instead! - -- Added more variables to -w: - - 'http_code' - 'time_namelookup' - 'time_connect' - 'time_pretransfer' - 'url_effective' - -- Made -w@filename read the syntax from a file and -w@- reads the syntax from - stdin in the good old "standard" curl way. - -Daniel (22 February 2000): -- Released a 6.5pre1 version to get some test and user feedback. - -Daniel (21 February 2000): - -- I added the -w/--write-out flag and some variables to go with it. -w is a - single string, whatever you enter there will be written out when curl has - completed a successful request. There are some variable substitutions and - they are specified as '%{variable}' (without the quotes). Variables that - exist as of this moment are: - - total_time - total transfer time in seconds (with 2 decimals) - size_download - total downloaded amount of bytes - size_upload - total uploaded amount of bytes - speed_download - the average speed of the entire download - speed_upload - the average speed of the entire upload - - I will of course add more variables, but I need input on these and others. - -- It struck me that the -# progress bar will be hard to just apply on the new - progress bar concept. I need some feedback on this before that'll get re- - introduced! :-/ - -Daniel (16 February 2000): -- Jörn Hartroth brought me some fixes for the progress meter and I continued - working on it. It seems to work for http download, http post, ftp download - and ftp upload. It should be a pretty good test it works generally good. - -- Still need to add the -# progress bar into the new style progress interface. - -- Gonna have a go at my new output option parameter next. - -Daniel (15 February 2000): -- The progress meter stuff is slowly taking place. There's more left before it - is working ok and everything is tested, but we're reaching there. Slowly! - -Daniel (11 February 2000): -- Paul Marquis fixed the config file parsing of curl to - deal with any-length lines, removing the previous limit of 4K. - -- Eetu Ojanen's suggestion of supporting the @-style for -b - is implemented. Now -b@<filename> works as well as the old style. -b@- also - similarly reads the cookies from stdin. - -- Reminder: -D should not write to the file until it needs to, in the same way - -o does. That would enable curl to use -b and -D on the same file... - -- Ellis Pritchard made getdate.y work for MacOS X. - -- Paul Harrington helped me out finding the crash in the - cookie parser. He also pointed out curl's habit of sending empty cookies to - the server. - -Daniel (8 February 2000): - - Ron Zapp corrected a problem in src/urlglob.c that - prevented curl from getting compiled on sunos 4. The problem had to do - with the difference in sprintf() return code types. - - - Transfer() should now be able to download and upload simultaneously. Let's - do some progress meter fixes later this week. - -Daniel (31 January 2000): - - Paul Harrington found another core dump in the cookie - parser. Curl doesn't properly recognize the 'version' keyword and I think - that is what caused this. I need to refresh some specs on cookies and see - what else curl lacks to improve this a bit more once and for all. - - RFC 2109 clearly specifies how cookies should be dealt with when they are - compliant with that spec. I don't think many servers are though... - - - Mark W. Eichin found that while curl is uploading a form - to a web site, it doesn't read incoming data why it'll hang after a while - since the socket "pipe" becomes full. - - It took me two hours to rewrite Download() and Upload() into the new - single function Transfer(). It even seems to work! More testing is required - of course... I should get the header-sending together in a kind of queue - and let them get "uploaded" in Transfer() as well. - - - Zhibiao Wu pointed out a curl bug in the location: area, - although I did not get a reproducible way to do this why I have to wait - with fixing anything. - - - Bob Schader suggested I should implement resume - support for the HTTP PUT operation, and as I think it is a valid suggestion - I'll work on it. - -Daniel (25 January 2000): - - M Travis Obenhaus pointed out a manual mixup with -y and -Y that was - corrected. - - - Jens Schleusener pointed out a problem to compile - curl on AIX 4.1.4 and gave me a solution. This problem was already fixed - by Jörn's recent #include modifications! - -Daniel (19 January 2000): - - Oskar Liljeblad pointed out and corrected a problem - in the Location: following system that made curl following a location: to a - different protocol to fail. - - At January 31st I re-considered this fix and the surrounding source code. I - could not really see that the patch did any difference, why I removed it - again for further research and debugging. (It disabled location: following - on server not running on default ports.) - - - Jörn Hartroth brought a fix that once again - made it possible to select progress bar. - - - Jörn also fixed a few include problems. - -Version 6.4 - -Daniel (17 January 2000): - - Based on suggestions from Björn Stenberg, I made the - progress deal better with larger files and added a "Time" field which shows - the time spent on the download so far. - - I'm now using the CVS repository on sourceforge.net, which also allows web - browsing. - -Daniel (10 January 2000): - - Renumbered some enums in curl/curl.h since tag number 35 was used twice! - - Added "postquote" support to the ftp section that enables post-ftp-transfer - quote commands. - - Now made the -Q/--quote parameter recognize '-' as a prefix, which means - that command will be issued AFTER a successful ftp transfer. This can of - course be used to delete or rename a file after it has been uploaded or - downloaded. Use your imagination! ;-) - - Since I do the main development on solaris 2.6 now, I had to download and - install GNU groff to generate the hugehelp.c file. The solaris nroff cores - on the man page! So, in order to make the solaris configure script find a - better result I made gnroff get checked prior to the regular nroff. - - Added all the curl exit codes to the man page. - - Jim Gallagher properly tracked down a bug in autoconf - 2.13. The AC_CHECK_LIB() macro wrongfully uses the -l flag before the -L - flag to 'ld' which causes the HP-UX 10.20 flavour to fail on all libchecks - and therefore you can't make the configure script find the openssl libs! - -Daniel (28 December 1999): - - Tim Verhoeven correctly identified that curl - doesn't support URL formatted file names when getting ftp. Now, there's a - problem with getting very weird file names off FTP servers. RFC 959 defines - that the file name syntax to use should be the same as in the native OS of - the server. Since we don't know the peer server system we currently just - translate the URL syntax into plain letters. It is still better and with - the solaris 2.6-supplied ftp server it works with spaces in the file names. - -Daniel (27 December 1999): - - When curl parsed cookies straight off a remote site, it corrupted the input - data, which, if the downloaded headers were stored made very odd characters - in the saved data. Correctly identified and reported by Paul Harrington. - -Daniel (13 December 1999): - - General cleanups in the library interface. There had been some bad kludges - added during times of stress and I did my best to clean them off. It was - both regarding the lib API as well as include file confusions. - -Daniel (3 December 1999): - - A small --stderr bug was reported by Eetu Ojanen... - - - who also brought the suggestion of extending the -X flag to ftp list as - well. So, now it is and the long option is now --request instead. It is - only for ftp list for now (and the former http stuff too of course). - -Lars J. Aas (24 November 1999): - - Patched curl to compile and build under BeOS. Doesn't work yet though! - - - Corrected the Makefile.am files to allow putting object files in - different directories than the sources. - -Version 6.3.1 - -Daniel (23 November 1999): - - I've had this major disk crash. My good old trust-worthy source disk died - along with the machine that hosted it. Thank goodness most of all the - things I've done are either backed up elsewhere or stored in this CVS - server! - - - Michael S. Steuer pointed out a bug in the -F handling - that made curl hang if you posted an empty variable such as '-F name='. It - was one of those old bugs that never have worked properly... - - - Jason Baietto pointed out a general flaw in the HTTP - download. Curl didn't complain if it was prematurely aborted before the - entire download was completed. It does now. - -Daniel (19 November 1999): - - Chris Maltby very accurately criticized the lack of - return code checks on the fwrite() calls. I did a thorough check for all - occurrences and corrected this. - -Daniel (17 November 1999): - - Paul Harrington pointed out that the -m/--max-time option - doesn't work for the slow system calls like gethostbyname()... I don't have - any good fix yet, just a slightly less bad one that makes curl exit hard - when the timeout is reached. - - - Bjorn Reese helped me point out a possible problem that might be the reason - why Thomas Hurst experience problems in his Amiga version. - - Daniel (12 November 1999): - - I found a crash in the new cookie file parser. It crashed when you gave - a plain http header file as input... - -Version 6.3 - - Daniel (10 November 1999): - - I kind of found out that the HTTP time-conditional GETs (-z) aren't always - respected by the web server and the document is therefore sent in whole - again, even though it doesn't match the requested condition. After reading - section 13.3.4 of RFC 2616, I think I'm doing the right thing now when I do - my own check as well. If curl thinks the condition isn't met, the transfer - is aborted prematurely (after all the headers have been received). - - - After comments from Robert Linden I also rewrote some parts of the man page - to better describe how the -F works. - - - Michael Anti put up a new curl download mirror in - China: http://www.pshowing.com/curl/ - - - I added the list of download mirrors to the README file - - - I did add more explanations to the man page - - Daniel (8 November 1999): - - I made the -b/--cookie option capable of reading netscape formatted cookie - files as well as normal http-header files. It should be able to - transparently figure out what kind of file it got as input. - - Daniel (29 October 1999): - - Another one of Sebastiaan van Erk's ideas (that has been requested before - but I seem to have forgotten who it was), is to add support for ranges in - FTP downloads. As usual, one request is just a request, when they're two - it is a demand. I've added simple support for X-Y style fetches. X has to - be the lower number, though you may omit one of the numbers. Use the -r/ - --range switch (previously HTTP-only). - - - Sebastiaan van Erk suggested that curl should be - able to show the file size of a specified file. I think this is a splendid - idea and the -I flag is now working for FTP. It displays the file size in - this manner: - Content-Length: XXXX - As it resembles normal headers, and leaves us the opportunity to add more - info in that display if we can come up with more in the future! It also - makes sense since if you access ftp through a HTTP proxy, you'd get the - file size the same way. - - I changed the order of the QUOTE command executions. They're now executed - just after the login and before any other command. I made this to enable - quote commands to run before the -I stuff is done too. - - - I found out that -D/--dump-header and -V/--version weren't documented in - the man page. - - - Many HTTP/1.1 servers do not support ranges. Don't ask me why. I did add - some text about this in the man page for the range option. The thread in - the mailing list that started this was initiated by Michael Anti. - - - I get reports about nroff crashes on solaris 2.6+ when displaying the curl - man page. Switch to gnroff instead, it is reported to work(!). Adam Barclay - reported and brought the suggestion. - - - In a dialogue with Johannes G. Kristinsson we came - up with the idea to let -H/--header specified headers replace the - internally generated headers, if you happened to select to add a header - that curl normally uses by itself. The advantage with this is not entirely - obvious, but in Johannes' case it means that he can use another Host: than - the one curl would set. - - Daniel (27 October 1999): - - Jongki Suwandi brought a nice patch for (yet another) crash when following - a location:. This time you had to follow a https:// server's redirect to - get the core. - -Version 6.2 - - Daniel (21 October 1999): - - I think I managed to remove the suspicious (nil) that has been seen just - before the "Host:" in HTTP requests when -v was used. - - I found out that if you followed a location: when using a proxy, without - having specified http:// in the URL, the protocol part was added once again - when moving to the next URL! (The protocol part has to be added to the - URL when going through a proxy since it has no protocol-guessing system - such as curl has.) - - Benjamin Ritcey reported a core dump under solaris 2.6 - with OpenSSL 0.9.4. It turned out this was due to a bad free() in main.c - that occurred after the download was done and completed. - - Benjamin found ftp downloads to show the first line of the download meter - to get written twice, and I removed that problem. It was introduced with - the multiple URL support. - - Dan Zitter correctly pointed out that curl 6.1 and earlier versions didn't - honor RFC 2616 chapter 4 section 2, "Message Headers": "...Field names are - case-insensitive..." HTTP header parsing assumed a certain casing. Dan - also provided me with a patch that corrected this, which I took the liberty - of editing slightly. - - Dan Zitter also provided a nice patch for config.guess to better recognize - the Mac OS X - - Dan also corrected a minor problem in the lib/Makefile that caused linking - to fail on OS X. - - Daniel (19 October 1999): - - Len Marinaccio came up with some problems with curl. Since Windows has a - crippled shell, it can't redirect stderr and that causes trouble. I added - --stderr today which allows the user to redirect the stderr stream to a - file or stdout. - - Daniel (18 October 1999): - - The configure script now understands the '--without-ssl' flag, which now - totally disable SSL/https support. Previously it wasn't possible to force - the configure script to leave SSL alone. The previous functionality has - been retained. Troy Engel helped test this new one. - -Version 6.1 (October 17 1999) - - Daniel (17 October 1999): - - I ifdef'ed or commented all the zlib stuff in the sources and configure - script. It turned out we needed to mock more with zlib than I initially - thought, to make it capable of downloading compressed HTTP documents and - uncompress them on the fly. I didn't mean the zlib parts of curl to become - more than minor so this means I halt the zlib expedition for now and wait - until someone either writes the code or zlib gets updated and better - adjusted for this kind of usage. I won't get into details here, but a - short a summary is suitable: - - zlib can't automatically detect whether to use zlib or gzip - decompression methods. - - zlib is very neat for reading gzipped files from a file descriptor, - although not as nice for reading buffer-based data such as we would - want it. - - there are still some problems with the win32 version when reading from - a file descriptor if that is a socket - - Daniel (14 October 1999): - - Moved the (external) include files for libcurl into a subdirectory named - curl and adjusted all #include lines to use <curl/XXXX> to maintain a - better name space and control of the headers. This has been requested. - - Daniel (12 October 1999): - - I modified the 'maketgz' script to perform a 'make' too before a release - archive is put together in an attempt to make the time stamps better and - hopefully avoid the double configure-running that use to occur. - - Daniel (11 October 1999): - - Applied Jörn's patches that fixes zlib for mingw32 compiles as well as - some other missing zlib #ifdef and more text on the multiple URL docs in - the man page. - -Version 6.1beta - - Daniel (6 October 1999): - - Douglas E. Wegscheid sent me a patch that made the exact same thing as I - just made: the -d switch is now capable of reading post data from a named - file or stdin. Use it similarly to the -F. To read the post data from a - given file: - - curl -d @path/to/filename www.postsite.com - - or let curl read it out from stdin: - - curl -d @- www.postit.com - - Jörn Hartroth (3 October 1999): - - Brought some more patches for multiple URL functionality. The MIME - separation ideas are almost scrapped now, and a custom separator is being - used instead. This is still compile-time "flagged". - - Daniel - - Updated curl.1 with multiple URL info. - - Daniel (30 September 1999): - - Felix von Leitner brought openssl-check fixes for configure.in to work - out-of-the-box when the openssl files are installed in the system default - dirs. - - Daniel (28 September 1999) - - Added libz functionality. This should enable decompressing gzip, compress - or deflate encoding HTTP documents. It also makes curl send an accept that - it accepts that kind of encoding. Compressed contents usually shortens - download time. I *need* someone to tell me a site that uses compressed HTTP - documents so that I can test this out properly. - - - As a result of the adding of zlib awareness, I changed the version string - a little. I plan to add openldap version reporting in there too. - - Daniel (17 September 1999) - - Made the -F option allow stdin when specifying files. By using '-' instead - of file name, the data will be read from stdin. - -Version 6.0 (September 14 1999) - - Daniel (13 September 1999) - - Added -X/--http-request <request> to enable any HTTP command to be sent. - Do not that your server has to support the exact string you enter. This - should possibly a string like DELETE or TRACE. - - - Applied Douglas' mingw32-fixes for the makefiles. - - Daniel (10 September 1999) - - Douglas E. Wegscheid pointed out a problem. Curl didn't check the FTP - servers return code properly after the --quote commands were issued. It - took anything non 200 as an error, when all 2XX codes should be accepted as - OK. - - - Sending cookies to the same site in multiple lines like curl used to do - turned out to be bad and breaking the cookie specs. Curl now sends all - cookies on a single Cookie: line. Curl is not yet RFC 2109 compliant, but I - doubt that many servers do use that syntax (yet). - - Daniel (8 September 1999) - - Jörn helped me make sure it still compiles nicely with mingw32 under win32. - - Daniel (7 September 1999) - - FTP upload through proxy is now turned into a HTTP PUT. Requested by - Stefan Kanthak. - - - Added the ldap files to the .m32 makefile. - - Daniel (3 September 1999) - - Made cookie matching work while using HTTP proxy. - - Bjorn Reese (31 August 1999) - - Passed his ldap:// patch. Note that this requires the openldap shared - library to be installed and that LD_LIBRARY_PATH points to the - directory where the lib will be found when curl is run with a - ldap:// URL. - - Jörn Hartroth (31 August 1999) - - Made the Mingw32 makefiles into single files. - - Made file:// work for Win32. The same code is now used for unix as well for - performance reasons. - - Douglas E. Wegscheid (30 August 1999) - - Patched the Mingw32 makefiles for SSL builds. - - Matthew Clarke (30 August 1999) - - Made a cool patch for configure.in to allow --with-ssl to specify the - root dir of the openssl installation, as in - - ./configure --with-ssl=/usr/ssl_here - - - Corrected the 'reconf' script to work better with some shells. - - Jörn Hartroth (26 August 1999) - - Fixed the Mingw32 makefiles in lib/ and corrected the file.c for win32 - compiles. - -Version 5.11 - - Daniel (25 August 1999) - - John Weismiller pointed out a bug in the header-line - realloc() system in download.c. - - - I added lib/file.[ch] to offer a first, simple, file:// support. It - probably won't do much good on win32 system at this point, but I see it - as a start. - - - Made the release archives get a Makefile in the root dir, which can be - used to start the compiling/building process easier. I haven't really - changed any INSTALL text yet, I wanted to get some feed-back on this - first. - - Daniel (17 August 1999) - - Another Location: bug. Curl didn't do proper relative locations if the - original URL had cgi-parameters that contained a slash. Nusu's page - again. - - - Corrected the NO_PROXY usage. It is a list of substrings that if one of - them matches the tail of the host name it should connect to, curl should - not use a proxy to connect there. Pointed out to me by Douglas - E. Wegscheid. I also changed the README text a little regarding this. - - Daniel (16 August 1999) - - Fixed a memory bug with http-servers that sent Location: to a Location: - page. Nusu's page showed this too. - - - Made cookies work a lot better. Setting the same cookie name several times - used to add more cookies instead of replacing the former one which it - should've. Nusu <nus at intergorj.ro> brought me an URL that made this - painfully visible... - - Troy (15 August 1999) - - Brought new .spec files as well as a patch for configure.in that lets the - configure script find the openssl files better, even when the include - files are in /usr/include/openssl - -Version 5.10 - - Daniel (13 August 1999) - - SSL_CTX_set_default_passwd_cb() has been modified in the 0.9.4 version of - OpenSSL. Now why couldn't they simply add a *new* function instead of - modifying the parameters of an already existing function? This way, we get - a compiler warning if compiling with 0.9.4 but not with earlier. So, I had - to come up with a #if construction that deals with this... - - - Made curl output the SSL version number get displayed properly with 0.9.4. - - Troy (12 August 1999) - - Added MingW32 (GCC-2.95) support under Win32. The INSTALL file was also - a bit rearranged. - - Daniel (12 August 1999) - - I had to copy a good <arpa/telnet.h> include file into the curl source - tree to enable the silly win32 systems to compile. The distribution rights - allows us to do that as long as the file remains unmodified. - - - I corrected a few minor things that made the compiler complain when - -Wall -pedantic was used. - - - I'm moving the official curl web page to curl.haxx.nu. I think it - will make it easier to remember as it is a lot shorter and less cryptic. - The old one still works and shows the same info. - - Daniel (11 August 1999) - - Albert Chin-A-Young mailed me another correction for NROFF in the - configure.in that is supposed to be better for IRIX users. - - Daniel (10 August 1999) - - Albert Chin-A-Young helped me with some stupid Makefile things, as well as - some fiddling with the getdate.c stuff that he had problems with under - HP-UX v10. getdate.y will now be compiled into getdate.c if the appropriate - yacc or bison is found by the configure script. Since this is slightly new, - we need to test the output getdate.c with win32 systems to make sure it - still compiles there. - - Daniel (5 August 1999) - - I've just setup a new mailing list with the intention to keep discussions - around libcurl development in it. I mainly expect it to be for thoughts and - brainstorming around a "next generation" library, rather than nitpicking - about the current implementation or details in the current libcurl. - - To join our happy bunch of future-looking geeks, enter 'subscribe - <address>' in the body of a mail and send it to - libcurl-request@listserv.fts.frontec.se. Curl bug reports, the usual curl - talk and everything else should still be kept in this mailing list. I've - started to archive this mailing list and have put the libcurl web page at - www.fts.frontec.se/~dast/libcurl/. - - - Stefan Kanthak contacted me regarding a few problems in the configure - script which he discovered when trying to make curl compile and build under - Siemens SINIX-Z V5.42B2004! - - - Marcus Klein very accurately informed me that src/version.h was not present - in the CVS repository. Oh, how silly... - - - Linus Nielsen rewrote the telnet:// part and now curl offers limited telnet - support. If you run curl like 'curl telnet://host' you'll get all output on - the screen and curl will read input from stdin. You'll be able to login and - run commands etc, but since the output is buffered, expect to get a little - weird output. - - This is still in its infancy and it might get changed. We need your - feed-back and input in how this is best done. - - WIN32 NOTE: I bet we'll get problems when trying to compile the current - lib/telnet.c on win32, but I think we can sort them out in time. - - - David Sanderson reported that FORCE_ALLOCA_H or HAVE_ALLOCA_H must be - defined for getdate.c to compile properly on HP-UX 11.0. I updated the - configure script to check for alloca.h which should make it. - - Daniel (4 August 1999) - - I finally got to understand Marcus Klein's ftp download resume problem, - which turns out to be due to different outputs from different ftp - servers. It makes ftp download resuming a little trickier, but I've made - some modifications I really believe will work for most ftp servers and I do - hope you report if you have problems with this! - - - Added text about file transfer resuming to README.curl. - - Daniel (2 August 1999) - - Applied a progress-bar patch from Lars J. Aas. It offers - a new styled progress bar enabled with -#/--progress-bar. - - T. Yamada <tai at imasy.or.jp> (30 July 1999) - - It breaks with segfault when 1) curl is using .netrc to obtain - username/password (option '-n'), and 2) is automatically redirected to - another location (option '-L'). - - There is a small bug in lib/url.c (block starting from line 641), which - tries to take out username/password from user- supplied command-line - argument ('-u' option). This block is never executed on first attempt since - CONF_USERPWD bit isn't set at first, but curl later turns it on when it - checks for CONF_NETRC bit. So when curl tries to redo everything due to - redirection, it segfaults trying to access *data->userpwd. - -Version 5.9.1 - - Daniel (30 July 1999) - - Steve Walch pointed out that there is a memory leak in the formdata - functions. I added a FormFree() function that is now used and supposed to - correct this flaw. - - - Mark Wotton reported: - 'curl -L https://www.cwa.com.au/' core dumps. I managed to cure this by - correcting the cleanup procedure. The bug seems to be gone with my OpenSSL - 0.9.2b, although still occurs when I run the ~100 years old SSLeay 0.8.0. I - don't know whether it is curl or SSLeay that is to blame for that. - - - Marcus Klein: - Reported an FTP upload resume bug that I really can't repeat nor understand. - I leave it here so that it won't be forgotten. - - Daniel (29 July 1999) - - Costya Shulyupin suggested support for longer URLs when following Location: - and I could only agree and fix it! - - - Leigh Purdie found a problem in the upload/POST department. It turned out - that http.c accidentaly cleared the pointer instead of the byte counter - when supposed to. - - - Costya Shulyupin pointed out a problem with port numbers and Location:. If - you had a server at a non-standard port that redirected to an URL using a - standard port number, curl still used that first port number. - - - Ralph Beckmann pointed out a problem when using both CONF_FOLLOWLOCATION - and CONF_FAILONERROR simultaneously. Since the CONF_FAILONERROR exits on - the 302-code that the follow location header outputs it will never show any - html on location: pages. I have now made it look for >=400 codes if - CONF_FOLLOWLOCATION is set. - - - 'struct slist' is now renamed to 'struct curl_slist' (as suggested by Ralph - Beckmann). - - - Joshua Swink and Rick Welykochy were the first to point out to me that the - latest OpenSSL package now have moved the standard include path. It is now - in /usr/local/ssl/include/openssl and I have now modified the --enable-ssl - option for the configure script to use that as the primary path, and I - leave the former path too to work with older packages of OpenSSL too. - - Daniel (9 June 1999) - - I finally understood the IRIX problem and now it seem to compile on it! - I am gonna remove those #define strcasecmp() things once and for all now. - - Daniel (4 June 1999) - - I adjusted the FTP reply 227 parser to make the PASV command work better - with more ftp servers. Appearantly the Roxen Challanger server replied - something curl 5.9 could deal with! :-( Reported by Ashley Reid-Montanaro - and Mark Butler brought a solution for it. - - Daniel (26 May 1999) - - Rearranged. README is new, the old one is now README.curl and I added a - README.libcurl with text I got from Ralph Beckmann. - - - I also updated the INSTALL text. - - Daniel (25 May 1999) - - David Jonathan Lowsky correctly pointed out that curl didn't properly deal - with form posting where the variable shouldn't have any content, as in curl - -F "form=" www.site.com. It was now fixed. - -Version 5.9 (May 22 1999) - - Daniel (22 May 1999) - - I've got a bug report from Aaron Scarisbrick in which he states he has some - problems with -L under FreeBSD 3.0. I have previously got another bug - report from Stefan Grether which points at an error with similar sympthoms - when using win32. I made the allocation of the new url string a bit faster - and different, don't know if it actually improves anything though... - - Daniel (20 May 1999) - - Made the cookie parser deal with CRLF newlines too. - - Daniel (19 May 1999) - - Download() didn't properly deal with failing return codes from the sread() - function. Adam Coyne found the problem in the win32 version, and Troy Engel - helped me out isolating it. - - Daniel (16 May 1999) - - Richard Adams pointed out a bug I introduced in 5.8. --dump-header doesn't - work anymore! :-/ I fixed it now. - - - After a suggestion by Joshua Swink I added -S / --show-error to force curl - to display the error message in case of an error, even if -s/--silent was - used. - - Daniel (10 May 1999) - - I moved the stuff concerning HTTP, DICT and TELNET it their own source - files now. It is a beginning on my clean-up of the sources to make them - layer all those protocols better to enable more to be added easier in the - future! - - - Leon Breedt sent me some files I've not put into the main curl - archive. They're for creating the Debian package thingie. He also sent me a - debian package that I've made available for download at the web page - - Daniel (9 May 1999) - - Made it compile on cygwin too. - - Troy Engel (7 May 1999) - - Brought a series of patches to allow curl to compile smoothly on MSVC++ 6 - again! - - Daniel (6 May 1999) - - I changed the #ifdef HAVE_STRFTIME placement for the -z code so that it - will be easier to discover systems that don't have that function and thus - can't use -z successfully. Made the strftime() get used if WIN32 is defined - too. - -Version 5.8 - - Daniel (5 May 1999) - - I've had it with this autoconf/automake mess. It seems to work allright - for most people who don't have automake installed, but for those who have - there are problems all over. - - I've got like five different bug reports on this only the last - week... Claudio Neves and Federico Bianchi and root <duggerj001 at - hawaii.rr.com> are some of them reporting this. - - Currently, I have no really good fix since I want to use automake myself to - generate the Makefile.in files. I've found out that the @SHELL@-problems - can often be fixed by manually invoking 'automake' in the archive root - before you run ./configure... I've hacked my maketgz script now to fiddle - a bit with this and my tests seem to work better than before at least! - - Daniel (4 May 1999) - - mkhelp.pl has been doing badly lately. I corrected a case problem in - the regexes. - - - I've now remade the -o option to not touch the file unless it needs to. - I had to do this to make -z option really fine, since now you can make a - curl fetch and use a local copy's time when downloading to that file, as - in: - - curl -z dump -o dump remote.site.com/file.html - - This will only get the file if the remote one is newer than the local. - I'm aware that this alters previous behaviour a little. Some scripts out - there may depend on that the file is always touched... - - - Corrected a bug in the SSLv2/v3 selection. - - - Felix von Leitner requested that curl should be able to send - "If-Modified-Since" headers, which indeed is a fair idea. I implemented it - right away! Try -z <expression> where expression is a full GNU date - expression or a file name to get the date from! - - Stephan Lagerholm (30 Apr 1999) - - Pointed out a problem with the src/Makefile for FreeBSD. The RM variable - isn't set and causes the make to fail. - - Daniel (26 April 1999) - - Am I silly or what? Irving Wolfe pointed out to me that the curl version - number was not set properly. Hasn't been since 5.6. This was due to a bug - in my maketgz script! - - David Eriksson (25 Apr 1999) - - Found a bug in cookies.c that made it crash at times. - -Version 5.7.1 - - Doug Kaufman (23 Apr 1999) - - Brought two sunos 4 fixes. One of them being the hostip.c fix mentioned - below and the other one a correction in include/stdcheaders.h - - - Added a paragraph about compiling with the US-version of openssl to the - INSTALL file. - - Daniel - - New mailing list address. Info updated on the web page as well as in the - README file - - Greg Onufer (20 Apr 1999) - - hostip.c didn't compile properly on SunOS 5.5.1. - It needs an #include <sys/types.h> - -Version 5.7 - - Daniel (Apr 20 1999) - - Decided to upload a non-beta version right now! - - - Made curl support any-length HTTP headers. The destination buffer is now - simply enlarged every time it turns out to be too small! - - - Added the FAQ file to the archive. Still a bit smallish, but it is a - start. - - Eric Thelin (15 Apr 1999) - - Made -D accept '-' instead of filename to write to stdout. - -Version 5.6.3beta - - Daniel (Apr 12 1999) - - - Changed two #ifdef WIN32 to better #ifdef <errorcode> when connect()ing - in url.c and ftp.c. Makes cygwin32 deal with them better too. We should - try to get some decent win32-replacement there. Anyone? - - - The old -3/--crlf option is now ONLY --crlf! - - - I changed the "SSL fix" to a more lame one, but that doesn't remove as - much functionality. Now I've enabled the lib to select what SSL version it - should try first. Appearantly some older SSL-servers don't like when you - talk v3 with them so you need to be able to force curl to talk v2 from the - start. The fix dated April 6 and posted on the mailing list forced curl to - use v2 at all times using a modern OpenSSL version, but we don't really - want such a crippled solution. - - - Marc Boucher sent me a patch that corrected a math error for the - "Curr.Speed" progress meter. - - - Eric Thelin sent me a patch that enables '-K -' to read a config file from - stdin. - - - I found out we didn't close the file properly before so I added it! - - Daniel (Apr 9 1999) - - Yu Xin pointed out a problem with ftp download resume. It didn't work at - all! ;-O - - Daniel (Apr 6 1999) - - Corrected the version string part generated for the SSL version. - - - I found a way to make some other SSL page work with openssl 0.9.1+ that - previously didn't (ssleay 0.8.0 works with it though!). Trying to get - some real info from the OpenSSL guys to see how I should do to behave the - best way. SSLeay 0.8.0 shouldn't be that much in use anyway these days! - -Version 5.6.2beta - - Daniel (Apr 4 1999) - - Finally have curl more cookie "aware". Now read carefully. This is how - it works. - To make curl read cookies from an already existing file, in plain header- - format (like from the headers of a previous fetch) invoke curl with the - -b flag like: - - curl -b file http://site/foo.html - - Curl will then use all cookies it finds matching. The old style that sets - a single cookie with -b is still supported and is used if the string - following -b includes a '=' letter, as in "-b name=daniel". - - To make curl read the cookies sent in combination with a location: (which - sites often do) point curl to read a non-existing file at first (i.e - to start with no existing cookies), like: - - curl -b nowhere http://site/setcookieandrelocate.html - - - Added a paragraph in the TODO file about the SSL problems recently - reported. Evidently, some kind of SSL-problem curl may need to address. - - - Better "Location:" following. - - Douglas E. Wegscheid (Tue, 30 Mar 1999) - - A subsecond display patch. - - Daniel (Mar 14 1999) - - I've separated the version number of libcurl and curl now. To make - things a little easier, I decided to start the curl numbering from - 5.6 and the former version number known as "curl" is now the one - set for libcurl. - - - Removed the 'enable-no-pass' from configure, I doubt anyone wanted - that. - - - Made lots of tiny adjustments to compile smoothly with cygwin under - win32. It's a killer for porting this to win32, bye bye VC++! ;-) - Compiles and builds out-of-the-box now. See the new wordings in - INSTALL for details. - - - Beginning experiments with downloading multiple document from a http - server while remaining connected. - -Version 5.6beta - - Daniel (Mar 13 1999) - - Since I've changed so much, I thought I'd just go ahead and implement the - suggestion from Douglas E. Wegscheid. -D or --dump-header is now storing - HTTP headers separately in the specified file. - - - Added new text to INSTALL on what to do to build this on win32 now. - - - Aaargh. I had to take a step back and prefix the shared #include files - in the sources with "../include/" to please VC++... - - Daniel (Mar 12 1999) - - Split the url.c source into many tiny sources for better readability - and smaller size. - - Daniel (Mar 11 1999) - - Started to change stuff for a move to make libcurl and a more separate - curl application that uses the libcurl. Made the libcurl sources into - the new lib directory while the curl application will remain in src as - before. New makefiles, adjusted configure script and so. - - libcurl.a built quickly and easily. I better make a better interface to - the lib functions though. - - The new root dir include/ is supposed to contain the public information - about the new libcurl. It is a little ugly so far :-) - - - Daniel (Mar 1 1999) - - Todd Kaufmann sent me a good link to Netscape's cookie spec as well as the - info that RFC 2109 specifies how to use them. The link is now in the - README and the RFC in the RESOURCES. - - Daniel (Feb 23 1999) - - Finally made configure accept --with-ssl to look for SSL libs and includes - in the "standard" place /usr/local/ssl... - - Daniel (Feb 22 1999) - - Verified that curl linked fine with OpenSSL 0.9.1c which seems to be - the most recent. - - Henri Gomez (Fri Feb 5 1999) - - Sent in an updated curl-ssl.spec. I still miss the script that builds an - RPM automatically... - -Version 5.5.1 - - Mark Butler (27 Jan 1999) - - Corrected problems in Download(). - - Danitel Stenberg (25 Jan 1999) - - Jeremie Petit pointed out a few flaws in the source that prevented it from - compile warning free with the native compiler under Digital Unix v4.0d. - -Version 5.5 - - Daniel Stenberg (15 Jan 1999) - - Added Bjorns small text to the README about the DICT protocol. - - Daniel Stenberg (11 Jan 1999) - - <jswink at softcom.net> reported about the win32-versioin: "Doesn't use - ALL_PROXY environment variable". Turned out to be because of the static- - buffer nature of the win32 environment variable calls! - - Bjorn Reese (10 Jan 1999) - - I have attached a simple addition for the DICT protocol (RFC 2229). - It performs dictionary lookups. The output still needs to be better - formatted. - - To test it try (the exact format, and more examples are described in - the RFC) - - dict://dict.org/m:hello - dict://dict.org/m:hello::soundex - - - Vicente Garcia (10 Jan 1999) - - Corrected the progress meter for files larger than 20MB. - - Daniel Stenberg (7 Jan 1999) - - Corrected the -t and -T help texts. They claimed to be FTP only. - -Version 5.4 - - Daniel Stenberg - (7 Jan 1999) - - Irving Wolfe reported that curl -s didn't always supress the progress - reporting. It was the form post that autoamtically always switched it on - again. This is now corrected! - - (4 Jan 1999) - - Andreas Kostyrka suggested I'd add PUT and he helped me out to test it. If - you use -t or -T now on a http or https server, PUT will be used for file - upload. - - I removed the former use of -T with HTTP. I doubt anyone ever really used - that. - - (4 Jan 1999) - - Erik Jacobsen found a width bug in the mprintf() function. I corrected it - now. - - (4 Jan 1999) - - As John V. Chow pointed out to me, curl accepted very limited URL sizes. It - should now accept path parts that are up to at least 4096 bytes. - - - Somehow I screwed up when applying the AIX fix from Gilbert Ramirez, so - I redid that now. - -Version 5.3a (win32 only) - - Troy Engel - - Corrected a win32 bug in the environment variable part. - -Version 5.3 - - Gilbert Ramirez Jr. (21 Dec 1998) - - I have implemented the "quote" function of FTP clients. It allows you to - send arbitrary commands to the remote FTP server. I chose the -Q/--quote - command-line arguments. - - You can have more than one quoted string, and curl will apply them in - order. This is what I use for my MVS upload: - - curl -B --crlf -Q "site lrecl=80" -Q "site blk=8000" -T file ftp://os390/test - - Curl will send the two quoted "site" commands in the proper order. - - - Made it compile smoothly on AIX. - - Gilbert Ramirez Jr. (18 Dec 1998) - - Brought an MVS patch: -3/--mvs, for ftp upload to the MVS ftp server. - - Troy Engel (17 Dec 1998) - - Brought a correction that fixes the win32 curl bug. - - Daniel Stenberg - - A bug, pointed out to me by Dr H. T. Leung, caused curl to crash on the -A - flag on certain systems. Actually, all systems should've! - - - Added a few defines to make directories/file names get build nicer (with _ - instead of . and \ instead of / in win32). - - - steve <fisk at polar.bowdoin.edu> reported a weird bug that occured if the - ftp server response line had a parenthesis on the line before the (size) - info. I hope it works better now! - -Version 5.2.1 - - Steven G. Johnson (Dec 14, 1998) - - Brought a fix that corrected a crash in 5.2 due to bad treatment of the - environment variables. - -Version 5.2 - - Daniel Stenberg (Dec 14, 1998) - - Rewrote the mkhelp script and now, the mkhelp.pl script generates the - hugehelp.c file from the README *and* the man page file curl.1. By using - both files, I no longer need to have double information in both the man - page and the README as well. So, win32-users will only have the hugehelp.c - file for all info, but then, they download the plain binary most times - anyway. - - - gcc2.8.1 with the -Wall flag complaints a lot on subscript has type `char' - if I don't explicitly typecast the argument to isdigit() or isspace() to - int. So I did to compile warning free with that too. - - - Added checks for 'long double' and 'long long' in the configure script. I - need those for the mprintf.c source to compile well on non long long - comforming systems! - -Version 5.1 (not publicly released) - - Daniel Stenberg (Dec 10, 1998) - - I got a request for a pre-compiled NT Alpha version. Anyone? - - - Added Lynx/CERN www lib proxy environment variable support. That means curl - now reads and understands the following environment variables: - - HTTP_PROXY, HTTPS_PROXY, FTP_PROXY, GOPHER_PROXY - - They should be set for protocol-specific proxies. General proxy should be - set with - - ALL_PROXY - - And a comma-separated list of host names that shouldn't go through any - proxy is set in (only an asterisk, '*' matches all hosts). - - NO_PROXY - - The usage of the -x/--proxy flag overrides the environment variables. - - - Proxy can now be specified with a procotol:// prefix. - - - Wrote the curl.1 man page. - - - Introduced a whole new dynamic buffer system for all sprintf()s. It is - based on the *printf() package by yours truly and Bjorn Reese. Hopefully, - there aren't that many buffer overflow risks left now. - - - Ah, I should mention I've compiled and built curl successfully under - solaris 2.6 with gcc now, gcc 2.7.2 won't work but 2.8.1 did ok. - - Oren Tirosh (Dec 3, 1998) - - Brought two .spec files, to use when creating (Linux) Redhat style RPM - packages. They're named curl.spec and curl-ssl.spec. - - Troy Engel - - Supplied the src/Makefile.vc6 for easy compiling with VC++ under Win32. - -Version 5.0 - - Daniel Stenberg (Dec 1, 1998) - - Not a single bug report in ages. - - Corrected getpass.c and main.c to compile warning and error free with the - Win32 VC++ crap. - -Version 5.0 beta 24 - - Daniel Stenberg (Nov 20, 1998) - - HOW TO BUILD A RELEASE ARCHIVE: - - * Pre-requisite software: - What To build what Reads data from - ==== ============= =============== - GNU automake Makefile.in, aclocal.m4 configure.in - GNU make(1) - " - - GNU gcc(1) - " - - GNU autoconf configure configure.in - GNU autoheader(2) config.h.in configure.in, acconfig.h - - * Make sure all files that should be part of the archive are put in FILES. - - * Run './maketgz' and enter version number of the new to become archive. - - maketgz does: - - - Enters the newly created version number in url.h. - - (If you don't have automake, this script will warn about that, but unless - you have changed the Makefile.am files, that is nothing to care about.) - If you have it, it'll run it. - - If you have autoconf, the configure.in will be edited to get the newly - created version number and autoconf will be run. - - Creates a new directory named curl-<version>. (Actually, it uses the base - name of the current directory up to the first '-'.) - - Copies all files mentioned in FILES to the new directory. Saving - permissions and directory structure. - - Uses tar to create an archive of it all, named curl-<version>.tar.gz - - gzips the archive - - Removes the new directory and all its contents. - - * When done, you have an archive stored in your directory named - curl-<version>.tar.gz. - - Done! - - (1) They're required to make automake run properly. - (2) It is distributed as a part of the GNU autoconf archive. - - Daniel Stenberg (Nov 18, 1998) - - I changed the TAG-system. If you ever used urlget() from this package in - another product, you need to recompile with the new headers. I did this - new stuff to better deal with different compilers and system with different - variable sizes. I think it makes it a little more portable. This proves - to compile warning free with the problematic IRIX compiler! - - Win32 compiled with a silly error. Corrected now. - - Brian Chaplin reported yet another problem in - multiline FTP responses. I've tried to correct it. I mailed him a new - version and I hope he gets back soon with positive feedback! - - Improved the 'maketgz' to create a temporary directory tree which it makes - an archive from instead of the previous renaming of the current one. - - Mailing list opened (see README). - - Made -v more verbose on the PASV section of ftp transfers. Now it tells - host name and IP of the new host (and port number). I also added a section - about PORT vs PASV in the README. - -Version 5.0 beta 21 - - Angus Mackay (Nov 15, 1998) - - Introduced automake stuff. - - Daniel Stenberg (Nov 13, 1998) - - Just made a successful GET of a document from an SSL-server using my own - private certificate for authentication! The certificate has to be in PEM - format. You do that the easiest way (although not *that* easy) by - downloading the SSLyeay PKCS#12-patch by Dr Stephen N. Henson from his site - at: http://www.drh-consultancy.demon.co.uk/. Using his tool, you can - convert any modern Netscape or (even) MSIE certificate to PEM-format. Use - it with 'curl -E <certificate:password> https://site.com'. If this isn't a - cool feature, then I don't know what cool features look like! ;-) - - Working slowly on telnet connections. #define TRY_TELNET to try it out. - (curl -u user:passwd "telnet://host.com/cat .login" is one example) I do - have problem to define how it should work. The prime purpose for this must - be to get (8bit clean) files via telnet, and it really isn't that easy to - get files this way. Still having problems with \n being converted to \r\n. - - Angus Mackay (Nov 12, 1998) - - Corrected another bug in the long parameter name parser. - - Modified getpass.c (NOTE: see the special licensing in the top of that - source file). - - Daniel Stenberg (Nov 12, 1998) - - We may have removed the silly warnings from url.c when compiled under IRIX. - Thanks again to Bjorn Reese and Martin Staael. - - Wrote formfind.pl which is a new perl script intended to help you find out - how a FORM submission should be done. This needs a little more work to get - really good. - - Daniel Stenberg (Nov 11, 1998) - - Made the HTTP header-checker accept white spaces before the HTTP/1.? line. - Appearantly some proxies/sites add such at times (my test proxy did when I - downloaded a gopher page with it)! - - Moved the former -h to -M and made -h show the short help text instead. I - had to enable a forced help text option. Now an even shorter help text will - be presented when an unknown option and similar, is used. - - stdcheaders.h didn't work with IRIX 6.4 native cc compiler. I hope my - changes don't make other versions go nuts instead. - - Daniel Stenberg (Nov 10, 1998) - - Added a weird check in the configure script to check for the silly AIX - warnings about my #define strcasecmp() stuff. I do that define to prevent - me and other contributors to accidentaly use that function name instead - of strequal()... - - I bugfixed Angus's getpass.c very little. - - Fixed the verbose flag names to getopt-style, i.e 'curl --loc' will be - sufficient instead of --location as "loc" is a unique prefix. Also, anything - after a '--' is treated as an URL. So if you do have a host with a weeeird - name you can do 'curl -- -host.com'. - - Another getopt-adjust; curl now accepts flags after the URL on the command - line. 'curl www.foo.com -O' is perfectly valid. - - Corrected the .curlrc parser so that strtok() is no longer used and I - believe it works better. Even URLs can be specified in it now. - - Angus Mackay (Nov 9, 1998) - - Replaced getpass.c with a newly written one, not under GPL license - - Changed OS to a #define in config.h instead of compiler flag - - Makefile now uses -DHAVE_CONFIG_H - - Daniel Stenberg (Nov 9, 1998) - - Ok, I expanded the tgz-target to update the version string on each occation - I build a release archive! - - I reacted on Angus Mackay's initiative and remade the parameter parser to - be more getopt compliant. Curl now supports "merged" flags as in - curl -lsv ftp.site.com - Do note that I had to move three short-names of the options. Parameters - that needs an additional string such as -x must be stand-alone or the - last in a merged sequence: - curl -lsx my-proxy ftp.site.com - is ok, but using the flags in a different order like '-lxs' would cause - unexpected results (as the 's' option would be skipped). - - I've changed the headers in all files that are subject to the MozPL - license, as they are supposed to look like when conforming. - - Made the configure script make the config.h. The former config.h is now - setup.h. - - The RESOURCES and TODO files have been added to the archive. - - Angus Mackay (Nov 5, 1998) - - Fixed getpass.c and various configure stuff - - Daniel Stenberg (Nov 3, 1998) - - Use -H/--header for custom HTTP-headers. Lets you pass on your own - specified headers to the remote server. I wouldn't recommend trying to use - a header with a defined usage according to standards. Use this flag once - for every custom header you want to add. - - Use -B/--ftp-ascii to force ftp to use ASCII mode when transfering files. - - Corrected the 'getlinks.pl' script, I accidentally left my silly proxy - usage in there! Since the introduction of the .curlrc file, it is easier to - write scripts that use curl since proxies and stuff should be in the - .curlrc file anyway. - - Introducing the new -F flag for HTTP POST. It supports multipart/form-data - which means it is gonna be possible to upload files etc through HTTP POST. - Shiraz Kanga asked for the feature and my brother, - Björn Stenberg helped me design the user - interface for this beast. This feature requires quite some docs, - since it has turned out not only quite capable, but also complicated! :-) - - A note here, since I've received mail about it. SSLeay versions prior to - 0.8 will *not* work with curl! - - Wil Langford reported a bug that occurred since curl - did not properly use CRLF when issuing ftp commands. I fixed it. - - Rearranged the order config files are read. .curlrc is now *always* read - first and before the command line flags. -K config files then act as - additional config items. - - Use -q AS THE FIRST OPTION specified to prevent .curlrc from being read. - - You can now disable a proxy by using -x "". Useful if the .curlrc file - specifies a proxy and you wanna fetch something without going through - that. - - I'm thinking of dropping the -p support. Its really not useful since ports - could (and should?) be specified as :<port> appended on the host name - instead, both in URLs and to proxy host names. - - Martin Staael reports curl -L bugs under Windows NT - (test with URL http://come.to/scsde). This bug is not present in this - version anymore. - - Added support for the weird FTP URL type= thing. You can download a file - using ASCII transfer by appending ";type=A" to the right of it. Other - available types are type=D for dir-list (NLST) and type=I for binary - transfer. I can't say I've ever seen anyone use this kind of URL though! - :-) - - Troy Engel pointed out a bug in my getenv("HOME") - usage for win32 systems. I introduce getenv.c to better cope with - this. Mr Engel helps me with the details around that... - - A little note to myself and others, I should make the win32-binary built - with SSL support... - - Ryan Nelson sent me comments about building curl - with SSL under FreeBSD. See the Makefile for details. Using the configure - script, it should work better and automatically now... - - Cleaned up in the port number mess in the source. No longer stores and uses - proxy port number separate from normal port number. - - 'configure' script working. Confirmed compiles on: - Host SSL Compiler - SunOS 5.5 no gcc - SunOS 5.5.1 yes gcc - SunOS 5.6 no cc (with gcc, it has the "gcc include files" problem) - SunOS 4.1.3 no gcc (without ANSI C headers) - SunOS 4.1.2 no gcc (native compiler failed) - Linux 2.0.18 no gcc - Linux 2.0.32 yes gcc - Linux 2.0.35 no gcc (with glibc) - IRIX 6.2 no gcc (cc compiles generate a few warnings) - IRIX 6.4 no cc (generated warnings though) - Win32 no Borland - OSF4.0 no ? - - - Ooops. The 5beta (and 4.10) under win32 failed if the HOME variable wasn't - set. - - When using a proxy, curl now guesses and uses the protocol part in cases - like: - curl -x proxy:80 www.site.com - Proxies normally go nuts unless http:// is prepended to the host name, so - if curl is used like this, it guesses protocol and appends the protocol - string before passing it to the proxy. It already did this when used - without proxy. - - Better port usage with SSL through proxy now. If you specified a different - https-port when accessing through a proxy, it didn't use that number - correctly. I also rewrote the code that parses the stuff read from the - proxy when you wanna connect through it with SSL. - - Bjorn Reese helped me work around one of the compiler - warnings on IRIX native cc compiles. - -Version 4.10 (Oct 26, 1998) - Daniel Stenberg - - John A. Bristor suggested a config file switch, - and since I've been having that idea kind of in the background for a long - time I rewrote the parameter parsing function a little and now I introduce - the -K/--config flag. I also made curl *always* (unless -K is used) try to - load the .curlrc file for command line parameters. The syntax for the - config file is the standard command line argument style. Details in 'curl - -h' or the README. - - I removed the -k option. Keep-alive isn't really anything anyone would - want to enable with curl anyway. - - Martin Staael helped me add the 'irix' target. Now - "make irix" should build curl successfully on non-gcc SGI machines. - - Single switches now toggle behaviours. I.e if you use -v -v the second - will switch off the verbose mode the first one enabled. This is so that - you can disable a default setting a .curlrc file enables etc. - -Version 4.9 (Oct 7, 1998) - Daniel Stenberg - - Martin Staael suggested curl would support cookies. - I added -b/--cookie to enable free-text cookie data to be passed. There's - also a little blurb about general cookie stuff in the README/help text. - - dmh <dmh at jet.es> suggested HTTP resume capabilities. Although you could - manually get curl to resume HTTP documents, I made the -c resume flag work - for HTTP too (unless -r is used too, which would be very odd anyway). - - Added checklinks.pl to the archive. It is a still experimental perl script - that checks all links of a web page by using curl. - - Rearranged the archive hierarchy a little. Build the executable in the - src/ dir from now on! - - Version 4.9 and hereafter, is no longer released under the GPL license. - I have now updated the LEGAL file etc and now this is released using the - Mozilla Public License to avoid the plague known as "the GPL virus". You - must make the source available if you decide to change and/or redistribute - curl, but if you decide to use curl within something else you do not need - to offer the world the source to that too. - - Curl did not like HTTP servers that sent no headers at all on a GET - request. It is a violation of RFC2068 but appearantly some servers do - that anyway. Thanks to Gordon Beaton for the report! - - -L/--location was added after a suggestion from Martin Staael. This makes - curl ATTEMPT to follow the Location: redirect if one is present in the HTTP - headers. If -i or -I is used with this flag, you will see headers from all - sites the Location: points to. Do note that the first server can point to a - second that points to a third etc. It seems the Location: parameter (said - to be an AbsoluteURI in RFC2068) isn't always absolute.. :-/ Anyway, I've - made curl ATTEMPT to do the best it can to deal with the reality. - - Added getlinks.pl to the archive. getlinks.pl selectively downloads - files that a web page links to. - -Version 4.8.4 - Daniel Stenberg - - As Julian Romero Nieto reported, curl reported wrong version number. - - As Teemu Yli-Elsila pointed out, the win32 version of 4.8 (and probably all - other versions for win32) didn't work with binary files since I'm too used - to the Unix style fopen() where binary and text don't differ... - - Ralph Beckmann brought me some changes that lets curl compile error and - warning free with -Wall -pedantic with g++. I also took the opportunity to - clean off some unused variables and similar. - - Ralph Beckmann made me aware of a really odd bug now corrected. When curl - read a set of headers from a HTTP server, divided into more than one read - and the first read showed a full line *exactly* (i.e ending with a - newline), curl did not behave well. - -Version 4.8.3 - Daniel Stenberg - - I was too quick to release 4.8.2 with too little testing. One of the - changes is now reverted slightly to the 4.8.1 way since 4.8.2 couldn't - upload files. I still think both problems corrected in 4.8.2 remain - corrected. Reported by Julian Romero Nieto. - -Version 4.8.2 - Daniel Stenberg - - Bernhard Iselborn reported two FTP protocol errors curl did. They're now - corrected. Both appeared when getting files from a MS FTP server! :-) - -Version 4.8.1 - Daniel Stenberg - - Added a last update of the progress meter when the transfer is done. The - final output on the screen didn't have to be the final size transfered - which made it sometimes look odd. - - Thanks to David Long I got rid of a silly bug that happened if a HTTP-page - had nothing but header. Appearantly Solaris deals with negative sizes in - fwrite() calls a lot better than Linux does... =B-] - -Version 4.8 (Aug 31, 1998) - Daniel Stenberg - - Continue FTP file transfer. -c is the switch. Note that you need to - specify a file name if you wanna resume a download (you can't resume a - download sent to stdout). Resuming upload may be limited by the server - since curl is then using the non-RFC959 command SIZE to get the size of - the target file before upload begins (to figure out which offset to - use). Use -C to specify the offset yourself! -C is handy if you're doing - the output to something else but a plain file or when you just want to get - the end of a file. - - recursiveftpget.pl now features a maximum recursive level argument. - -Version 4.7 - Daniel Stenberg - - Added support to abort a download if the speed is below a certain amount - (speed-limit) bytes per second for a certain (speed-time) time. - - Wrote a perl script 'recursiveftpget.pl' to recursively use curl to get a - whole ftp directory tree. It is meant as an example of how curl can be - used. I agree it isn't the wisest thing to do to make a separate new - connection for each file and directory for this. - -Version 4.6 - Daniel Stenberg - - Added a first attempt to optionally parse the .netrc file for login user - and password. If used with http, it enables user authentication. -n is - the new switch. - - Removed the extra newlines on the default user-agent string. - - Corrected the missing ftp upload error messages when it failed without the - verbose flag set. Gary W. Swearingen found it. - - Now using alarm() to enable second-precision timeout even on the name - resolving/connecting phase. The timeout is although reset after that first - sequence. (This should be corrected.) Gary W. Swearingen reported. - - Now spells "Unknown" properly, as in "Unknown option 'z'"... :-) - - Added bug report email address in the README. - - Added a "current speed" field to the progress meter. It shows the average - speed the last 5 seconds. The other speed field shows the average speed of - the entire transfer so far. - -Version 4.5.1 - Linas Vepstas - - SSL through proxy fix - - Added -A to allow User-Agent: changes - - Daniel Stenberg - - Made the -A work when SSL-through-proxy. - -Version 4.5 - Linas Vepstas - - More SSL corrections - - I've added a port to AIX. - - running SSL through a proxy causes a chunk of code to be executred twice. - one of those blocks needs to be deleted. - - Daniel Stenberg - - Made -i and -I work again - -Version 4.4 - Linas Vepstas - - -x can now also specify proxyport when used as in 'proxyhost:proxyport' - - SSL fixes - -Version 4.3 - Daniel Stenberg - - Adjusted to compile under win32 (VisualC++ 5). The -P switch does not - support network interface names in win32. I couldn't figure out how! - -Version 4.2 - Linas Vepstas / Sampo Kellomaki - - Added SSL / SSLeay support (https://) - - Added the -T usage for HTTP POST. - - Daniel Stenberg - - Bugfixed the SSL implementation. - - Made -P a lot better to use other IP addresses. It now accepts a following - parameter that can be either - interface - i.e "eth0" to specify which interface's IP address you - want to use - IP address - i.e "192.168.10.1" to specify exact IP number - host name - i.e "my.host.domain" to specify machine - "-" - (any single-letter string) to make it pick the machine's - default - - The Makefile is now ready to compile for solaris, sunos4 and linux right - out of the box. - - Better generated version string seen with 'curl -V' - -Version 4.1 - Daniel Stenberg - - The IP number returned by the ftp server as a reply to PASV does no longer - have to DNS resolve. In fact, no IP-number-only addresses have to anymore. - - Binds better to available port when -P is used. - - Now LISTs ./ instead of / when used as in ftp://ftp.funet.fi/. The reason - for this is that exactly that site, ftp.funet.fi, does not allow LIST / - while LIST ./ is fine. Any objections? - -Version 4 (1998-03-20) - Daniel Stenberg - - I took another huge step and changed both version number and project name! - The reason for the new name is that there are just one too many programs - named urlget already and this program already can a lot more than merely - getting URLs, and the reason for the version number is that I did add the - pretty big change in -P and since I changed name I wanted to start with - something fresh! - - The --style flags are working better now. - - Listing directories with FTP often reported that the file transfer was - incomplete. Wrong assumptions were too common for directories, why no - size will be attempted to get compared on them from now on. - - Implemented the -P flag that let's the ftp control issue a PORT command - instead of the standard PASV. - - -a for appending FTP uploads works. - -*************************************************************************** - -Version 3.12 (14 March 1998) - Daniel Stenberg - - End-of-header tracking still lacked support for \r\n or just \n at the - end of the last header line. - Sergio Barresi - - Added PROXY authentication. - Rafael Sagula - - Fixed some little bugs. - -Version 3.11 - Daniel Stenberg - - The header parsing was still not correct since the 3.2 modification... - -Version 3.10 - Daniel Stenberg - - 3.7 and 3.9 were simultaneously developed and merged into this version. - - FTP upload did not work correctly since 3.2. - -Version 3.9 - Rafael Sagula - - Added the "-e <url> / --referer <url>" option where we can specify - the referer page. Obviously, this is necessary only to fool the - server, but... - -Version 3.7 - Daniel Stenberg - - Now checks the last error code sent from the ftp server after a file has - been received or uploaded. Wasn't done previously. - - When 'urlget <host>' is used without a 'protocol://' first in the host part, - it now checks for host names starting with ftp or gopher and if it does, - it uses that protocol by default instead of http. - -Version 3.6 - Daniel Stenberg - - Silly mistake made the POST bug. This has now also been tested to work with - proxy. - -Version 3.5 - Daniel Stenberg - - Highly inspired by Rafael Sagula's changes to the 3.1 that added an almost - functional POST, I applied his changes into this version and made them work. - (It seems POST requires the Content-Type and Content-Length headers.) It is - now usable with the -d switch. - -Version 3.3 - 3.4 - Passed to avoid confusions - -Version 3.2 - Daniel Stenberg - - Major rewrite of two crucial parts of this code: upload and download. - They are both now using a select() switch, that allows much better - progress meter and time control. - - alarm() usage removed completely - - FTP get can now list directory contents if the path ends with a slash '/'. - Urlget on a ftp-path that doesn't end with a slash means urlget will - attempt getting it as a file name. - - FTP directory view supports -l for "list-only" which lists the file names - only. - - All operations support -m for max time usage in seconds allowed. - - FTP upload now allows the size of the uploaded file to be provided, and - thus it can better check it actually uploaded the whole file. It also - makes the progress meter for uploads much better! - - Made the parameter parsing fail in cases like 'urlget -r 900' which - previously tried to connect to the host named '900'. - -Version 3.1 - Kjell Ericson - - Pointed out how to correct the 3 warnings in win32-compiles. - - Daniel Stenberg - - Removed all calls to exit(). - - Made the short help text get written to stdout instead of stderr. - - Made this file instead of keeping these comments in the source. - - Made two callback hooks, that enable external programs to use urlget() - easier and to grab the output/offer the input easier. - - It is evident that Win32-compiles are painful. I watched the output from - the Borland C++ v5 and it was awful. Just ignore all those warnings. - -Version 3.0 - Daniel Stenberg - - Added FTP upload capabilities. The name urlget gets a bit silly now - when we can put too... =) - - Restructured the source quite a lot. - Changed the urlget() interface. This way, we will survive changes much - better. New features can come and old can be removed without us needing - to change the interface. I've written a small explanation in urlget.h - that explains it. - - New flags include -t, -T, -O and -h. The -h text is generated by the new - mkhelp script. - -Version 2.9 - Remco van Hooff - - Added a fix to make it compile smoothly on Amiga using the SAS/C - compiler. - - Daniel Stenberg - - Believe it or not, but the STUPID Novell web server seems to require - that the Host: keyword is used, so well I use it and I (re-introduce) the - urlget User-Agent:. I still have to check that this Host: usage works with - proxies... 'Host:' is required for HTTP/1.1 GET according to RFC2068. - -Version 2.8 - Rafael Sagula - - some little modifications - -Version 2.7 - Daniel Stenberg - - Removed the -l option and introduced the -f option instead. Now I'll - rewrite the former -l kludge in an external script that'll use urlget to - fetch multipart files like that. - - '-f' is introduced, it means Fail without output in case of HTTP server - errors (return code >=400). - - Added support for -r, ranges. Specify which part of a document you - want, and only that part is returned. Only with HTTP/1.1-servers. - - Split up the source in 3 parts. Now all pure URL functions are in - urlget.c and stuff that deals with the stand-alone program is in main.c. - - I took a few minutes and wrote an embryo of a README file to explain - a few things. - -Version 2.6 - Daniel Stenberg - - Made the -l (loop) thing use the new CONF_FAILONERROR which makes - urlget() return error code if non-successful. It also won't output anything - then. Now finally removed the HTTP 1.0 and error 404 dependencies. - - Added -I which uses the HEAD request to get the header only from a - http-server. - -Version 2.5 - Rafael Sagula - - Made the progress meter use HHH:MM:SS instead of only seconds. - -Version 2.4 - Daniel Stenberg - - Added progress meter. It appears when downloading > BUFFER SIZE and - mute is not selected. I found out that when downloading large files from - really really slow sites, it is desirable to know the status of the - download. Do note that some downloads are done unawaring of the size, which - makes the progress meter less thrilling ;) If the output is sent to a tty, - the progress meter is shut off. - - Increased buffer size used for reading. - - Added length checks in the user+passwd parsing. - - Made it grok user+passwd for HTTP fetches. The trick is to base64 - encode the user+passwd and send an extra header line. Read chapter 11.1 in - RFC2068 for details. I added it to be used just like the ftp one. To get a - http document from a place that requires user and password, use an URL - like: - - http://user:passwd@www.site.to.leach/doc.html - - I also added the -u flag, since WHEN USING A PROXY YOU CAN'T SPECIFY THE - USER AND PASSWORD WITH HTTP LIKE THAT. The -u flag works for ftp too, but - not if used with proxy. To do the same as the above one, you can invoke: - - urlget -u user:passwd http://www.site.to.leach/doc.html - -Version 2.3 - Rafael Sagula - - Added "-o" option (output file) - - Added URG_HTTP_NOT_FOUND return code. - (Daniel's note:) - Perhaps we should detect all kinds of errors and instead of writing that - custom string for the particular 404-error, use the error text we actually - get from the server. See further details in RFC2068 (HTTP 1.1 - definition). The current way also relies on a HTTP/1.0 reply, which newer - servers might not do. - - Looping mode ("-l" option). It's easier to get various split files. - (Daniel's note:) - Use it like 'urlget -l 1 http://from.this.site/file%d.html', which will - make urlget to attempt to fetch all files named file1.html, file2.html etc - until no more files are found. This is only a modification of the - STAND_ALONE part, nothing in the urlget() function was modfified for this. - Daniel Stenberg - - Changed the -h to be -i instead. -h should be preserved to help use. - - Bjorn Reese indicated that Borland _might_ use '_WIN32' instead of the - VC++ WIN32 define and therefore I added a little fix for that. - -Version 2.2 - Johan Andersson - - The urlget function didn't set the path to url when using proxy. - - Fixed bug with IMC proxy. Now using (almost) complete GET command. - - Daniel Stenberg - - Made it compile on Solaris. Had to reorganize the includes a bit. - (so Win32, Linux, SunOS 4 and Solaris 2 compile fine.) - - Made Johan's keepalive keyword optional with the -k flag (since it - makes a lot of urlgets take a lot longer time). - - Made a '-h' switch in case you want the HTTP-header in the output. - -Version 2.1 - Daniel Stenberg and Kjell Ericson - - Win32-compilable - - No more global variables - - Mute option (no output at all to stderr) - - Full range of return codes from urlget(), which is now written to be a - function for easy-to-use in [other] programs. - - Define STAND_ALONE to compile the stand alone urlget program - - Now compiles with gcc options -ansi -Wall -pedantic ;) - -Version 2.0 - - Introducing ftp GET support. The FTP URL type is recognized and used. - - Renamed the project to 'urlget'. - - Supports the user+passwd in the FTP URL (otherwise it tries anonymous - login with a weird email address as password). - -Version 1.5 - Daniel Stenberg - - The skip_header() crap messed it up big-time. By simply removing that - one we can all of a sudden download anything ;) - - No longer requires a trailing slash on the URLs. - - If the given URL isn't prefixed with 'http://', HTTP is assumed and - given a try! - - 'void main()' is history. - -Version 1.4 - Daniel Stenberg - - The gopher source used the ppath variable instead of path which could - lead to disaster. - -Version 1.3 - Daniel Stenberg - - Well, I added a lame text about the time it took to get the data. I also - fought against Johan to prevent his -f option (to specify a file name - that should be written instead of stdout)! =) - - Made it write 'connection refused' for that particular connect() - problem. - - Renumbered the version. Let's not make silly 1.0.X versions, this is - a plain 1.3 instead. - -Version 1.2 - Johan Andersson - - Discovered and fixed the problem with getting binary files. puts() is - now replaced with fwrite(). (Daniel's note: this also fixed the buffer - overwrite problem I found in the previous version.) - - Rafael Sagula - - Let "-p" before "-x". - - Daniel Stenberg - - Bugfixed the proxy usage. It should *NOT* use nor strip the port number - from the URL but simply pass that information to the proxy. This also - made the user/password fields possible to use in proxy [ftp-] URLs. - (like in ftp://user:password@ftp.my.site:8021/README) - - Johan Andersson - - Implemented HTTP proxy support. - - Receive byte counter added. - - Bjorn Reese - - Implemented URLs (and skipped the old syntax). - - Output is written to stdout, so to achieve the above example, do: - httpget http://143.54.10.6/info_logo.gif > test.gif - -Version 1.1 - Daniel Stenberg - - Adjusted it slightly to accept named hosts on the command line. We - wouldn't wanna use IP numbers for the rest of our lifes, would we? - -Version 1.0 - Rafael Sagula - - Wrote the initial httpget, which started all this! |