| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
curl: show the libcurl release date in --version output
Bugfixes:
CVE-2017-9502: default protocol drive letter buffer overflow
openssl: fix memory leak in servercert
tests: remove the html and PDF versions from the tarball
mbedtls: enable NTLM (& SMB) even if MD4 support is unavailable
typecheck-gcc: handle function pointers properly
llist: no longer uses malloc
gnutls: removed some code when --disable-verbose is configured
lib: fix maybe-uninitialized warnings
multi: clarify condition in curl_multi_wait
schannel: Don't treat encrypted partial record as pending data
configure: fix the -ldl check for openssl, add -lpthread check
configure: accept -Og and -Ofast GCC flags
Makefile: avoid use of GNU-specific form of $<
if2ip: fix -Wcast-align warning
configure: stop prepending to LDFLAGS, CPPFLAGS
curl: set a 100K buffer size by default
typecheck-gcc: fix _curl_is_slist_info
nss: do not leak PKCS 11 slot while loading a key
nss: load libnssckbi.so if no other trust is specified
examples: ftpuploadfrommem.c
url: declare get_protocol_family() static
examples/cookie_interface.c: changed to example.com
test1443: test --remote-time
curl: use utimes instead of obsolescent utime when available
url: fixed a memory leak on OOM while setting CURLOPT_BUFFERSIZE
curl_rtmp: fix missing-variable-declarations warnings
tests: fixed OOM handling of unit tests to abort test
curl_setup: Ensure no more than one IDN lib is enabled
tool: Fix missing prototype warnings for CURL_DOES_CONVERSIONS
CURLOPT_BUFFERSIZE: 1024 bytes is now the minimum size
curl: non-boolean command line args reject --no- prefixes
telnet: Write full buffer instead of byte-by-byte
typecheck-gcc: add missing string options
typecheck-gcc: add support for CURLINFO_SOCKET
opt man pages: they all have examples now
curl_setup_once: use SEND_QUAL_ARG2 for swrite
test557: set a known good numeric locale
schannel: return a more specific error code for SEC_E_UNTRUSTED_ROOT
tests/server: make string literals const
runtests: use -R for random order
unit1305: fix compiler warning
curl_slist_append.3: clarify a NULL input creates a new list
tests/server: run checksrc by default in debug-builds
tests: fix -Wcast-qual warnings
runtests.pl: simplify the datacheck read section
curl: remove --environment and tool_writeenv.c
buildconf: fix hang on IRIX
tftp: silence bad-function-cast warning
asyn-thread: fix unused macro warnings
tool_parsecfg: fix -Wcast-qual warning
sendrecv: fix MinGW-w64 warning
test537: use correct variable type
rand: treat fake entropy the same regardless of endianness
curl: generate the --help output
tests: removed redundant --trace-ascii arguments
multi: assign IDs to all timers and make each timer singleton
multi: use a fixed array of timers instead of malloc
mbedtls: Support server renegotiation request
pipeline: fix mistakenly trying to pipeline POSTs
lib510: don't write past the end of the buffer if it's too small
CURLOPT_HTTPPROXYTUNNEL.3: clarify, add example
SecureTransport/DarwinSSL: Implement public key pinning
curl.1: clarify --config
curl_sasl: fix build error with CURL_DISABLE_CRYPTO_AUTH + USE_NTLM
darwinssl: Fix exception when processing a client-side certificate
curl.1: mention --oauth2-bearer's argument
mkhelp.pl: do not add current time into curl binary
asiohiper.cpp / evhiperfifo.c: deal with negative timerfunction input
ssh: fix memory leak in disconnect due to timeout
tests: stabilize test 1034
cmake: auto detection of CURL_CA_BUNDLE/CURL_CA_PATH
assert: avoid, use DEBUGASSERT instead
LDAP: using ldap_bind_s on Windows with methods
redirect: store the "would redirect to" URL when max redirs is reached
winbuild: fix the nghttp2 build
examples: fix -Wimplicit-fallthrough warnings
time: fix type conversions and compiler warnings
mbedtls: fix variable shadow warning
test557: fix ubsan runtime error due to int left shift
transfer: init the infilesize from the postfields
docs: clarify NO_PROXY further
build-wolfssl: Sync config with wolfSSL 3.11
curl-compilers.m4: enable -Wshift-sign-overflow for clang
example/externalsocket.c: make it use CLOSESOCKETFUNCTION too
lib574.c: use correct callback proto
lib583: fix compiler warning
curl-compilers.m4: fix compiler_num for clang
typecheck-gcc.h: separate getinfo slist checks from other pointers
typecheck-gcc.h: check CURLINFO_TLS_SSL_PTR and CURLINFO_TLS_SESSION
typecheck-gcc.h: check CURLINFO_CERTINFO
build: provide easy code coverage measuring
test1537: dedicated tests of the URL (un)escape API calls
curl_endian: remove unused functions
test1538: verify the libcurl strerror API calls
MD(4|5): silence cast-align clang warning
dedotdot: fixed output for ".." and "." only input
cyassl: define build macros before including ssl.h
updatemanpages.pl: error out on too old git version
curl_sasl: fix unused-variable warning
x509asn1: fix implicit-fallthrough warning with GCC 7
libtest: fix implicit-fallthrough warnings with GCC 7
BINDINGS: add Ring binding
curl_ntlm_core: pass unsigned char to toupper
test1262: verify ftp download with -z for "if older than this"
test1521: test all curl_easy_setopt options
typecheck-gcc: allow CURLOPT_STDERR to be NULL too
metalink: remove unused printf() argument
file: make speedcheck use current time for checks
configure: fix link with librtmp when specifying path
examples/multi-uv.c: fix deprecated symbol
cmake: Fix inconsistency regarding mbed TLS include directory
setopt: check CURLOPT_ADDRESS_SCOPE option range
gitignore: ignore all vim swap files
urlglob: fix division by zero
libressl: OCSP and intermediate certs workaround no longer needed
|
|
|
|
|
|
|
|
Curl and libcurl 7.54.0
Public curl releases: 165
Command line options: 207
curl_easy_setopt() options: 245
Public functions in libcurl: 61
Contributors: 1538
This release includes the following changes:
o Add CURL_SSLVERSION_MAX_* constants to CURLOPT_SSLVERSION [19]
o Add --max-tls [19]
o Add CURLOPT_SUPPRESS_CONNECT_HEADERS [24]
o Add --suppress-connect-headers [24]
This release includes the following bugfixes:
o CVE-2017-7468: switch off SSL session id when client cert is used [68]
o cmake: Replace invalid UTF-8 byte sequence [1]
o tests: use consistent environment variables for setting charset
o proxy: fixed a memory leak on OOM
o ftp: removed an erroneous free in an OOM path
o docs: de-duplicate file lists in the Makefiles [2]
o ftp: fixed a NULL pointer dereference on OOM
o gopher: fixed detection of an error condition from Curl_urldecode
o url: fix unix-socket support for proxy-disabled builds [3]
o test1139: allow for the possibility that the man page is not rebuilt
o cyassl: get library version string at runtime
o digest_sspi: fix compilation warning
o tests: enable HTTP/2 tests to run with non-default port numbers
o warnless: suppress compiler warning
o darwinssl: Warn that disabling host verify also disables SNI [4]
o configure: fix for --enable-pthreads [5]
o checksrc.bat: Ignore curl_config.h.in, curl_config.h
o no-keepalive.d: fix typo [6]
o configure: fix --with-zlib when a path is specified [7]
o build: fix gcc7 implicit fallthrough warnings [8]
o fix potential use of uninitialized variables [9]
o CURLOPT_SSL_CTX_FUNCTION.3: Fix EXAMPLE formatting errors [10]
o CMake: Reorganize SSL support, separate WinSSL and SSPI [11]
o CMake: Add DarwinSSL support [12]
o CMake: Add mbedTLS support [13]
o ares: return error at once if timed out before name resolve starts [14]
o BINDINGS: added C++, perl, go and Scilab bindings
o URL: return error on malformed URLs with junk after port number
o KNOWN_BUGS: Add DarwinSSL won't import PKCS#12 without a password [15]
o http2: Fix assertion error on redirect with CL=0 [16]
o updatemanpages.pl: Update man pages to use current date and versions [17]
o --insecure: clarify that this option is for server connections [18]
o mkhelp: simplified the gzip code
o build: fixed making man page in out-of-tree tarball builds
o tests: disabled 1903 due to flakiness
o openssl: add two /* FALLTHROUGH */ to satisfy coverity
o cmdline-opts: fixed a few typos
o authneg: clear auth.multi flag at http_done [20]
o curl_easy_reset: Also reset the authentication state [21]
o proxy: skip SSL initialization for closed connections [22]
o http_proxy: ignore TE and CL in CONNECT 2xx responses [23]
o tool_writeout: fixed a buffer read overrun on --write-out
o make: regenerate docs/curl.1 by running make in docs [25]
o winbuild: add basic support for OpenSSL 1.1.x [26]
o build: removed redundant DEPENDENCIES from makefiles
o CURLINFO_LOCAL_PORT.3: added example
o curl: show HTTPS-Proxy options on CURLE_SSL_CACERT [27]
o tests: strip more options from non-HTTP --libcurl tests
o tests: fixed the documented test server port numbers
o runtests.pl: fixed display of the Gopher IPv6 port number
o multi: fix streamclose() crash in debug mode [28]
o cmake: build manual pages [29]
o cmake: add support for building HTML and PDF docs [30]
o mbedtls: add support for CURLOPT_SSL_CTX_FUNCTION [31]
o make: introduce 'test-nonflaky' target
o CURLINFO_PRIMARY_IP.3: add example
o tests/README: mention nroff for --manual tests [32]
o mkhelp: disable compression if the perl gzip module is unavailable
o openssl: fall back on SSL_ERROR_* string when no error detail [33]
o asiohiper: make sure socket is open in event_cb [34]
o tests/README: make "Run" section foolproof [35]
o curl: check for end of input in writeout backslash handling
o .gitattributes: turn off CRLF for *.am [36]
o multi: fix MinGW-w64 compiler warnings
o schannel: fix variable shadowing warning
o openssl: exclude DSA code when OPENSSL_NO_DSA is defined [37]
o http: Fix proxy connection reuse with basic-auth [38]
o pause: handle mixed types of data when paused [39]
o http: do not treat FTPS over CONNECT as HTTPS
o conncache: make hashkey avoid malloc [40]
o make: use the variable MAKE for recursive calls [41]
o curl: fix callback argument inconsistency [42]
o NTLM: check for features with #ifdef instead of #if [43]
o cmake: add several missing files to the dist
o select: use correct SIZEOF_ constant [44]
o connect: fix unreferenced parameter warning
o schannel: fix unused variable warning
o gcc7: fix ‘*’ in boolean context [45]
o http2: silence unused parameter warnings
o ssh: fix narrowing conversion warning
o telnet: (win32) fix read callback return variable [46]
o docs: Explain --fail-early does not imply --fail [47]
o docs: added examples for CURLINFO_FILETIME.3 and CURLOPT_FILETIME.3
o tests/server/util: remove in6addr_any for recent MinGW [48]
o multi: make curl_multi_wait avoid malloc in the typical case [49]
o include: curl/system.h is a run-time version of curlbuild.h [50]
o easy: silence compiler warning
o llist: replace Curl_llist_alloc with Curl_llist_init [51]
o hash: move key into hash struct to reduce mallocs [52]
o url: don't free postponed data on connection reuse [53]
o curl_sasl: declare mechtable static
o curl: fix Windows Unicode build
o multi: fix queueing of pending easy handles [54]
o tool_operate: fix MinGW compiler warning [55]
o low_speed_limit: improved function for longer time periods [56]
o gtls: fix compiler warning
o sspi: print out InitializeSecurityContext() error message [57]
o schannel: fix compiler warnings [58]
o vtls: fix unreferenced variable warnings
o INSTALL.md: fix secure transport configure arguments
o CURLINFO_SCHEME.3: fix variable type
o libcurl-thread.3: also mention threaded-resolver [59]
o nss: load CA certificates even with --insecure [60]
o openssl: fix this statement may fall through [61]
o poll: prefer <poll.h> over <sys/poll.h> [62]
o polarssl: unbreak build with versions < 1.3.8 [63]
o Curl_expire_latest: ignore already expired timers [64]
o configure: turn implicit function declarations into errors [65]
o mbedtls: fix memory leak in error path [66]
o http2: fix handle leak in error path [67]
o .gitattributes: force shell scripts to LF [69]
o configure.ac: ignore CR after version numbers [70]
o extern-scan.pl: strip trailing CR [71]
o openssl: make SSL_ERROR_to_str more future-proof [72]
o openssl: fix thread-safety bugs in error-handling [73]
o openssl: don't try to print nonexistant peer private keys [74]
o nss: fix MinGW compiler warnings [75]
|
|
Add upstream patch fixing CVE-2017-7407.
|
|
Bugfixes:
* cyassl: fix typo
* url: Improve CURLOPT_PROXY_CAPATH error handling
* urldata: include curl_sspi.h when Windows SSPI is enabled
* formdata: check for EOF when reading from stdin
* tests: Set CHARSET & LANG to UTF-8 in 1035, 2046 and 2047
* url: Default the proxy CA bundle location to CURL_CA_BUNDLE
* rand: added missing #ifdef HAVE_FCNTL_H around fcntl.h header
|
|
Curl and libcurl 7.53.0
This release includes the following changes:
o unix_socket: added --abstract-unix-socket and CURLOPT_ABSTRACT_UNIX_SOCKET [25]
o CURLOPT_BUFFERSIZE: support enlarging receive buffer [29]
This release includes the following bugfixes:
o CVE-2017-2629: make SSL_VERIFYSTATUS work again [64]
o gnutls-random: check return code for failed random
o openssl-random: check return code when asking for random
o http: remove "Curl_http_done: called premature" message
o cyassl: use time_t instead of long for timeout
o build-wolfssl: Sync config with wolfSSL 3.10
o ftp-gss: check for init before use
o configure: accept --with-libidn2 instead [1]
o ftp: failure to resolve proxy should return that error code
o curl.1: add three more exit codes
o docs/ciphers: link to our own new page about ciphers
o vtls: s/SSLEAY/OPENSSL - fixes multi_socket timeouts with openssl [2]
o darwinssl: fix iOS build [3]
o darwinssl: fix CFArrayRef leak [4]
o cmake: use crypt32.lib when building with OpenSSL on windows [5]
o curl_formadd.3: CURLFORM_CONTENTSLENGTH not needed when chunked [6]
o digest_sspi: copy terminating NUL as well [7]
o curl: fix --remote-time incorrect times on Windows [8]
o curl.1: several updates and corrections [11]
o content_encoding: change return code on a failure
o curl.h: CURLE_FUNCTION_NOT_FOUND is no longer in use
o docs: TCP_KEEPALIVE start and interval default to 60 [9]
o darwinssl: --insecure overrides --cacert if both settings are in use [10]
o TheArtOfHttpScripting: grammar
o CIPHERS.md: document GSKit ciphers
o wolfssl: support setting cipher list
o wolfssl: display negotiated SSL version and cipher
o lib506: fix build for Open Watcom [12]
o asiohiper: improved socket handling [13]
o examples: make the C++ examples follow our code style too
o tests/sws: retry send() on EWOULDBLOCK [14]
o cmake: Fix passing _WINSOCKAPI_ macro to compiler [15]
o smtp: Fix STARTTLS denied error message
o imap/pop3: don't print response character in STARTTLS denied messages [16]
o rand: make it work without TLS backing [17]
o url: fix parsing for when 'file' is the default protocol [18]
o url: allow file://X:/path URLs on windows again [19]
o gnutls: check for alpn and ocsp in configure [20]
o IDN: Use TR46 'non-transitional' for toASCII translations [21]
o url: Fix NO_PROXY env var to work properly with --proxy option [22]
o CURLOPT_PREQUOTE.3: takes a struct curl_slist*, not a char* [23]
o docs: Add note about libcurl copying strings to CURLOPT_* manpages [24]
o curl: reset the easy handle at --next
o --next docs: --trace and --trace-ascii are also global
o --write-out docs: 'time_total' is not always shown with ms precision
o http: print correct HTTP string in verbose output when using HTTP/2
o docs: improved language in README.md HISTORY.md CONTRIBUTE.md [26]
o http2: disable server push if not requested [27]
o nss: use the correct lock in nss_find_slot_by_name()
o usercertinmem.c: improve the short description
o CURLOPT_CONNECT_TO: Fix compile warnings
o docs: non-blocking SSL handshake is now supported with NSS
o *.rc: escape non-ASCII/non-UTF-8 character for clarity [28]
o mbedTLS: fix multi interface non-blocking handshake [30]
o PolarSSL: fix multi interface non-blocking handshake [31]
o VC: remove the makefile.vc6 build infra [32]
o telnet: fix windows compiler warnings [33]
o cookies: do not assume a valid domain has a dot
o polarssl: fix hangs
o gnutls: disable TLS session tickets [34]
o mbedtls: disable TLS session tickets [35]
o mbedtls: implement CTR-DRBG and HAVEGE random generators [36]
o openssl: Don't use certificate after transferring ownership [37]
o cmake: Support curl --xattr when built with cmake [38]
o OS400: Fix symbols [39]
o docs: Add more HTTPS proxy documentation [40]
o docs: use more HTTPS links [41]
o cmdline-opts: Fixed build and test in out of source tree builds
o CHANGES.0: removed
o schannel: Remove incorrect SNI disabled message [42]
o darwinssl: Avoid parsing certificates when not in verbose mode [43]
o test552: Fix typos [44]
o telnet: Fix typos [45]
o transfer: only retry nobody-requests for HTTP [46]
o http2: reset push header counter fixes crash [47]
o nss: make FTPS work with --proxytunnel [48]
o test1139: Added the --manual keyword since the manual is required
o polarssl, mbedtls: Fix detection of pending data [49]
o http_proxy: Fix tiny memory leak upon edge case connecting to proxy [50]
o URL: only accept ";options" in SMTP/POP3/IMAP URL schemes [51]
o curl.1: ftp.sunet.se is no longer an FTP mirror
o tool_operate: Show HTTPS-Proxy options on CURLE_SSL_CACERT [52]
o http2: fix memory-leak when denying push streams [53]
o configure: Allow disabling pthreads, fall back on Win32 threads [54]
o curl: fix typo in time condition warning message [55]
o axtls: adapt to API changes [56]
o tool_urlglob: Allow a glob range with the same start and stop [57]
o winbuild: add note on auto-detection of MACHINE in Makefile.vc [58]
o http: fix missing 'Content-Length: 0' while negotiating auth [59]
o proxy: fix hostname resolution and IDN conversion [60]
o docs: fix timeout handling in multi-uv example
o digest_sspi: Fix nonce-count generation in HTTP digest [61]
o sftp: improved checks for create dir failures [62]
o smb: use getpid replacement for windows UWP builds [63]
o digest_sspi: Handle 'stale=TRUE' directive in HTTP digest [65]
|
|
|
|
|
|
Fixed in 7.52.1
Bugfixes:
CVE-2016-9594: unititialized random
lib557: fix checksrc warnings
lib: fix MSVC compiler warnings
lib557.c: use a shorter MAXIMIZE representation
tests: run checksrc on debug builds
|
|
Version 7.52.0 (20 Dec 2016)
Changes:
nss: map CURL_SSLVERSION_DEFAULT to NSS default
vtls: support TLS 1.3 via CURL_SSLVERSION_TLSv1_3
curl: introduce the --tlsv1.3 option to force TLS 1.3
curl: Add --retry-connrefused
proxy: Support HTTPS proxy and SOCKS+HTTP(s)
add CURLINFO_SCHEME, CURLINFO_PROTOCOL, and %{scheme}
curl: add --fail-early
Bugfixes:
CVE-2016-9586: printf floating point buffer overflow
CVE-2016-9952: Win CE schannel cert wildcard matches too much
CVE-2016-9953: Win CE schannel cert name out of buffer read
msvc: removed a straggling reference to strequal.c
winbuild: remove strcase.obj from curl build
examples: bugfixed multi-uv.c
configure: verify that compiler groks -Werror=partial-availability
mbedtls: fix build with mbedtls versions < 2.4.0
dist: add unit test CMakeLists.txt to the tarball
curl -w: added more decimal digits to timing counters
easy: Initialize info variables on easy init and duphandle
cmake: disable poll for macOS
http2: Don't send header fields prohibited by HTTP/2 spec
ssh: check md5 fingerprints case insensitively (regression)
openssl: initial TLS 1.3 adaptions
curl_formadd.3: *_FILECONTENT and *_FILE need the file to be kept
printf: fix ".*f" handling
examples/fileupload.c: fclose the file as well
SPNEGO: Fix memory leak when authentication fails
realloc: use Curl_saferealloc to avoid common mistakes
openssl: make sure to fail in the unlikely event that PRNG seeding fails
URL-parser: for file://[host]/ URLs, the [host] must be localhost
timeval: prefer time_t to hold seconds instead of long
Curl_rand: fixed and moved to rand.c
glob: fix [a-c] globbing regression
darwinssl: fix SSL client certificate not found on MacOS Sierra
curl.1: Clarify --dump-header only writes received headers
http2: Fix address sanitizer memcpy warning
http2: Use huge HTTP/2 windows
connects: Don't mix unix domain sockets with regular ones
url: Fix conn reuse for local ports and interfaces
x509: Limit ASN.1 structure sizes to 256K
checksrc: add more checks
winbuild: add config option ENABLE_NGHTTP2
http2: check nghttp2_session_set_local_window_size exists
http2: Fix crashes when parent stream gets aborted
CURLOPT_CONNECT_TO: Skip non-matching "connect-to" entries
URL parser: reject non-numerical port numbers
CONNECT: reject TE or CL in 2xx responses
CONNECT: read responses one byte at a time
curl: support zero-length argument strings in config files
openssl: don't use OpenSSL's ERR_PACK
curl.1: generated with the new man page system
curl_easy_recv: Improve documentation and example program
Curl_getconnectinfo: avoid checking if the connection is closed
CIPHERS.md: attempt to document TLS cipher names
|
|
Curl and libcurl 7.51.0
Public curl releases: 160
Command line options: 185
curl_easy_setopt() options: 225
Public functions in libcurl: 61
Contributors: 1467
This release includes the following changes:
o nss: additional cipher suites are now accepted by CURLOPT_SSL_CIPHER_LIST
o New option: CURLOPT_KEEP_SENDING_ON_ERROR [10]
This release includes the following bugfixes:
o CVE-2016-8615: cookie injection for other servers [28]
o CVE-2016-8616: case insensitive password comparison [29]
o CVE-2016-8617: OOB write via unchecked multiplication [30]
o CVE-2016-8618: double-free in curl_maprintf [31]
o CVE-2016-8619: double-free in krb5 code [32]
o CVE-2016-8620: glob parser write/read out of bounds [33]
o CVE-2016-8621: curl_getdate read out of bounds [34]
o CVE-2016-8622: URL unescape heap overflow via integer truncation [35]
o CVE-2016-8623: Use-after-free via shared cookies [36]
o CVE-2016-8624: invalid URL parsing with '#' [37]
o CVE-2016-8625: IDNA 2003 makes curl use wrong host [38]
o openssl: fix per-thread memory leak using 1.0.1 or 1.0.2 [1]
o http: accept "Transfer-Encoding: chunked" for HTTP/2 as well [2]
o LICENSE-MIXING.md: update with mbedTLS dual licensing [3]
o examples/imap-append: Set size of data to be uploaded [4]
o test2048: fix url
o darwinssl: disable RC4 cipher-suite support
o CURLOPT_PINNEDPUBLICKEY.3: fix the AVAILABILITY formatting
o openssl: don’t call CRYTPO_cleanup_all_ex_data [5]
o libressl: fix version output [6]
o easy: Reset all statistical session info in curl_easy_reset [7]
o curl_global_cleanup.3: don't unload the lib with sub threads running [8]
o dist: add CurlSymbolHiding.cmake to the tarball
o docs: Remove that --proto is just used for initial retrieval [9]
o configure: Fixed builds with libssh2 in a custom location
o curl.1: --trace supports % for sending to stderr!
o cookies: same domain handling changed to match browser behavior [11]
o formpost: trying to attach a directory no longer crashes [12]
o CURLOPT_DEBUGFUNCTION.3: fixed unused argument warning [13]
o formpost: avoid silent snprintf() truncation
o ftp: fix Curl_ftpsendf
o mprintf: return error on too many arguments
o smb: properly check incoming packet boundaries [14]
o GIT-INFO: remove the Mac 10.1-specific details [15]
o resolve: add error message when resolving using SIGALRM [16]
o cmake: add nghttp2 support [17]
o dist: remove PDF and HTML converted docs from the releases [18]
o configure: disable poll() in macOS builds [19]
o vtls: only re-use session-ids using the same scheme
o pipelining: skip to-be-closed connections when pipelining [20]
o win: fix Universal Windows Platform build [21]
o curl: do not set CURLOPT_SSLENGINE to DEFAULT automatically [22]
o maketgz: make it support "only" generating version info
o Curl_socket_check: add extra check to avoid integer overflow
o gopher: properly return error for poll failures
o curl: set INTERLEAVEDATA too
o polarssl: clear thread array at init
o polarssl: fix unaligned SSL session-id lock
o polarssl: reduce #ifdef madness with a macro
o curl_multi_add_handle: set timeouts in closure handles [23]
o configure: set min version flags for builds on mac [24]
o INSTALL: converted to markdown => INSTALL.md
o curl_multi_remove_handle: fix a double-free [25]
o multi: fix inifinte loop in curl_multi_cleanup() [26]
o nss: fix tight loop in non-blocking TLS handhsake over proxy [27]
o mk-ca-bundle: Change URL retrieval to HTTPS-only by default [39]
o mbedtls: stop using deprecated include file [40]
o docs: fix req->data in multi-uv example [41]
o configure: Fix test syntax for monotonic clock_gettime
o CURLMOPT_MAX_PIPELINE_LENGTH.3: Clarify it's not for HTTP/2 [42]
This release includes the following known bugs:
o see docs/KNOWN_BUGS (https://curl.haxx.se/docs/knownbugs.html)
This release would not have looked like this without help, code, reports and
advice from friends like these:
Akshay Vernekar, Alexander Sinditskiy, Anders Bakken, Andreas Streichardt,
Andrei Sedoi, Bernard Spil, Christian Heimes, Dan Fandrich,
Daniel Gustafsson, Daniel Stenberg, Darío Hereñú, David Woodhouse,
Fernando Muñoz, Gregory Szorc, Jeroen Ooms, Kamil Dudka, Luật Nguyễn,
lukaszgn on github, Marcel Raad, Martin Frodl, Martin Storsjö,
Michael Kaufmann, Michael Osipov, Miloš Ljumović, Nick Zitzmann,
nopjmp on github, Paul Joyce, Rainer Müller, Ray Satiro, Remo E,
Rider Linden, Sebastian Mundry, Sergei Kuzmin, Stephen Brokenshire,
Tobias Stoeckmann, Toby Peterson, Todd Short, Tony Kelman, Torben Dannhauer,
Valentin David,
(40 contributors)
Thanks! (and sorry if I forgot to mention someone)
References to bug reports and discussions on issues:
[1] = https://curl.haxx.se/bug/?i=964
[2] = https://curl.haxx.se/bug/?i=1013
[3] = https://curl.haxx.se/bug/?i=1019
[4] = https://curl.haxx.se/bug/?i=1011
[5] = https://curl.haxx.se/mail/lib-2016-09/0045.html
[6] = https://curl.haxx.se/bug/?i=1029
[7] = https://curl.haxx.se/bug/?i=1017
[8] = https://curl.haxx.se/bug/?i=997
[9] = https://curl.haxx.se/bug/?i=1031
[10] = https://curl.haxx.se/libcurl/c/CURLOPT_KEEP_SENDING_ON_ERROR.html
[11] = https://curl.haxx.se/bug/?i=1050
[12] = https://curl.haxx.se/bug/?i=1053
[13] = https://curl.haxx.se/bug/?i=1056
[14] = https://curl.haxx.se/bug/?i=1052
[15] = https://curl.haxx.se/bug/?i=1049
[16] = https://curl.haxx.se/bug/?i=1066
[17] = https://curl.haxx.se/bug/?i=922
[18] = https://curl.haxx.se/mail/lib-2016-10/0040.html
[19] = https://curl.haxx.se/bug/?i=1057
[20] = https://curl.haxx.se/bug/?i=1075
[21] = https://curl.haxx.se/bug/?i=1048
[22] = https://curl.haxx.se/bug/?i=1042
[23] = https://curl.haxx.se/bug/?i=739
[24] = https://curl.haxx.se/bug/?i=1069
[25] = https://curl.haxx.se/bug/?i=1083
[26] = https://curl.haxx.se/mail/lib-2016-10/0011.html
[27] = https://bugzilla.redhat.com/1388162
[28] = https://curl.haxx.se/docs/adv_20161102A.html
[29] = https://curl.haxx.se/docs/adv_20161102B.html
[30] = https://curl.haxx.se/docs/adv_20161102C.html
[31] = https://curl.haxx.se/docs/adv_20161102D.html
[32] = https://curl.haxx.se/docs/adv_20161102E.html
[33] = https://curl.haxx.se/docs/adv_20161102F.html
[34] = https://curl.haxx.se/docs/adv_20161102G.html
[35] = https://curl.haxx.se/docs/adv_20161102H.html
[36] = https://curl.haxx.se/docs/adv_20161102I.html
[37] = https://curl.haxx.se/docs/adv_20161102J.html
[38] = https://curl.haxx.se/docs/adv_20161102K.html
[39] = https://curl.haxx.se/bug/?i=1012
[40] = https://curl.haxx.se/bug/?i=1087
[41] = https://curl.haxx.se/bug/?i=1088
[42] = https://curl.haxx.se/bug/?i=1059
|
|
|
|
Curl and libcurl 7.50.3
This release includes the following bugfixes:
o CVE-2016-7167: escape and unescape integer overflows [8]
o mk-ca-bundle.pl: use SHA256 instead of SHA1
o checksrc: detect strtok() use
o errors: new alias CURLE_WEIRD_SERVER_REPLY [1]
o http2: support > 64bit sized uploads [2]
o openssl: fix bad memory free (regression) [3]
o CMake: hide private library symbols [4]
o http: refuse to pass on response body with NO_NODY was set [5]
o cmake: fix curl-config --static-libs [6]
o mbedtls: switch off NTLM in build if md4 isn't available [7]
o curl: --create-dirs on windows groks both forward and backward slashes [9]
|
|
Bugfixes:
---------
mbedtls: Added support for NTLM
SSH: fixed SFTP/SCP transfer problems
multi: make Curl_expire() work with 0 ms timeouts
mk-ca-bundle.pl: -m keeps ca cert meta data in output
TFTP: Fix upload problem with piped input
CURLOPT_TCP_NODELAY: now enabled by default
mbedtls: set verbose TLS debug when MBEDTLS_DEBUG is defined
http2: always wait for readable socket
cmake: Enable win32 large file support by default
cmake: Enable win32 threaded resolver by default
winbuild: Avoid setting redundant CFLAGS to compile commands
curl.h: make CURL_NO_OLDIES define CURL_STRICTER
docs: make more markdown files use .md extension
docs: CONTRIBUTE and LICENSE-MIXING were converted to markdown
winbuild: Allow changing C compiler via environment variable CC
rtsp: accept any RTSP session id
HTTP: retry failed HEAD requests on reused connections too
configure: add zlib search with pkg-config
openssl: accept subjectAltName iPAddress if no dNSName match
MANUAL: Remove invalid link to LDAP documentation
socks: improved connection procedure
proxy: reject attempts to use unsupported proxy schemes
proxy: bring back use of "Proxy-Connection:"
curl: allow "pkcs11:" prefix for client certificates
spnego_sspi: fix memory leak in case *outlen is zero
SOCKS: improve verbose output of SOCKS5 connection sequence
SOCKS: display the hostname returned by the SOCKS5 proxy server
http/sasl: Query authentication mechanism supported by SSPI before using
sasl: Don't use GSSAPI authentication when domain name not specified
win: Basic support for Universal Windows Platform apps
nss: fix incorrect use of a previously loaded certificate from file
nss: work around race condition in PK11_FindSlotByName()
ftp: fix wrong poll on the secondary socket
openssl: build warning-free with 1.1.0 (again)
HTTP: stop parsing headers when switching to unknown protocols
test219: Add http as a required feature
TLS: random file/egd doesn't have to match for conn reuse
schannel: Disable ALPN for Wine since it is causing problems
http2: make sure stream errors don't needlessly close the connection
http2: return CURLE_HTTP2_STREAM for unexpected stream close
darwinssl: --cainfo is intended for backward compatibility only
speed caps: not based on average speeds anymore
configure: make the cpp -P detection not clobber CPPFLAGS
http2: use named define instead of magic constant in read callback
http2: skip the content-length parsing, detect unknown size
http2: return EOF when done uploading without known size
darwinssl: test for errSecSuccess in PKCS12 import rather than noErr
openssl: fix CURLINFO_SSL_VERIFYRESULT
|
|
Bugfixes:
TLS: switch off SSL session id when client cert is used
TLS: only reuse connections with the same client cert
curl_multi_cleanup: clear connection pointer for easy handles
include the CURLINFO_HTTP_VERSION man page into the release tarball
include the http2-server.pl script in the release tarball
test558: fix test by stripping file paths from FD lines
spnego: Corrected miss-placed * in Curl_auth_spnego_cleanup() declaration
tests: Fix for http/2 feature
cmake: Fix for schannel support
curl.h: make public types void * again
win32: fix a potential memory leak in Curl_load_library
travis: fix OSX build by re-installing libtool
mbedtls: Fix debug function name
|
|
Fixed in 7.50.0 - July 21 2016
Changes:
http: add CURLINFO_HTTP_VERSION and %{http_version}
Bugfixes:
memdebug: fix MSVC crash with -DMEMDEBUG_LOG_SYNC
openssl: fix build with OPENSSL_NO_COMP
mbedtls: removed unused variables
cmake: Added missing mbedTLS support
URL parser: allow URLs to use one, two or three slashes
curl: fix -q [regression]
openssl: Use correct buffer sizes for error messages
curl: fix SIGSEGV while parsing URL with too many globs
schannel: add CURLOPT_CERTINFO support
vtls: fix ssl session cache race condition
http: Fix HTTP/2 connection reuse [regression]
checksrc: Add LoadLibrary to the banned functions list
schannel: Disable ALPN on Windows < 8.1
configure: occasional ignorance of --enable-symbol-hiding with GCC
http2: test17xx are the first real HTTP/2 tests
resolve: add support for IPv6 DNS64/NAT64 Networks on OS X + iOS
curl_multi_socket_action.3: rewording
CURLOPT_POSTFIELDS.3: Clarify what happens when set empty
cmake: Fix build with winldap
openssl: fix cert check with non-DNS name fields present
curl.1: mention the units for the progress meter
openssl: use more 'const' to fix build warnings with 1.1.0 branch
cmake: now using BUILD_TESTING=ON/OFF
vtls: Only call add/getsession if session id is enabled
headers: forward declare CURL, CURLM and CURLSH as structs
configure: improve detection of CA bundle path on FreeBSD
SFTP: set a generic error when no SFTP one exists
curl_global_init.3: expand on the SSL and WIN32 bits purpose
conn: don't free easy handle data in handler->disconnect
cookie.c: Fix misleading indentation
library: Fix memory leaks found during static analysis
CURLMOPT_SOCKETFUNCTION.3: fix typo
curl_global_init: moved the "IPv6 works" check here
connect: disable TFO on Linux when using SSL
vauth: Fixed memory leak due to function returning without free
winbuild: fix embedded manifest option
|
|
|
|
|
|
Bugfixes:
Windows: prevent DLL hijacking, CVE-2016-4802
dist: include manpage-scan.pl, nroff-scan.pl and CHECKSRC.md
schannel: fix compile break with MSVC XP toolset
curlbuild.h.dist: check __LP64__ as well to fix MIPS build
dist: include curl_multi_socket_all.3
http2: use HTTP/2 in the HTTP/1.1-alike response
openssl: ERR_remove_thread_state() is deprecated in latest 1.1.0
CURLOPT_CONNECT_TO.3: user must not free the list prematurely
libcurl.m4: Avoid obsolete warning
winbuild/Makefile.vc: Fix check on SSL, MBEDTLS, WINSSL exclusivity
curl_multibyte: fix compiler error
openssl: cleanup must free compression methods (memory leak)
mbedtls: fix includes so snprintf() works
checksrc.pl: Added variants of strcat() & strncat() to banned function list
contributors.sh: better grep pattern and show GitHub username
ssh: fix build for libssh2 before 1.2.6
curl_share_setopt.3: Add min ver needed for ssl session lock
|
|
Fixed in 7.49.0 - May 18 2016
Changes:
schannel: Add ALPN support
SSH: support CURLINFO_FILETIME
SSH: new CURLOPT_QUOTE command "statvfs"
wolfssl: Add ALPN support
http2: added --http2-prior-knowledge
http2: added CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE
libcurl: added CURLOPT_CONNECT_TO
curl: added --connect-to
libcurl: added CURLOPT_TCP_FASTOPEN
curl: added --tcp-fastopen
curl: remove support for --ftpport, -http-request and --socks
Bugfixes:
CVE-2016-3739: TLS certificate check bypass with mbedTLS/PolarSSL
checksrc.bat: Updated the help to be consistent with generate.bat
checksrc.bat: Added support for scanning the tests and examples
openssl: fix ERR_remove_thread_state() for boringssl/libressl
openssl: boringssl provides the same numbering as openssl
multi: fix "Operation timed out after" timer
url: don't use bad offset in tld_check_name to show error
sshserver.pl: use quotes for given options
Makefile.am: skip the scripts dir
curl: warn for --capath use if not supported by libcurl
http2: fix connection reuse
GSS: make Curl_gss_log_error more verbose
build-wolfssl: Allow a broader range of ciphers (Visual Studio)
wolfssl: Use ECC supported curves extension
openssl: Fix compilation warnings
Curl_add_buffer_send: avoid possible NULL dereference
SOCKS5_gssapi_negotiate: don't assume little-endian ints
strerror: don't bit shift a signed integer
url: Corrected get protocol family for FTP and LDAP
curl/mprintf.h: remove support for _MPRINTF_REPLACE
upload: missing rewind call could make libcurl hang
IMAP: check pointer before dereferencing it
build: Changed the Visual Studio projects warning level from 3 to 4
checksrc: now stricter, wider checks, code cleaned up
checksrc: added docs/CHECKSRC.md
curl_sasl: Fixed potential null pointer utilisation
krb5: Fixed missing client response when mutual authentication enabled
krb5: Only process challenge when present
krb5: Only generate a SPN when its not known
formdata: use appropriate fopen() macros
curl.1: -w filename_effective was introduced in 7.26.0
http2: make use of the nghttp2 error callback
http2: fix connection reuse when PING comes after last DATA
curl.1: change example for -F
HTTP2: Add a space character after the status code
curl.1: use example.com more
mbedtls.c: changed private prefix to mbed_
mbedtls: implement and provide *_data_pending() to avoid hang
mbedtls: fix MBEDTLS_DEBUG builds
ftp/imap/pop3/smtp: Allow the service name to be overridden
CURLOPT_SOCKS5_GSSAPI_SERVICE: Merged with CURLOPT_PROXY_SERVICE_NAME
build: include scripts/ in the dist
http2: Add handling stream level error
http2: Improve header parsing
makefile.vc6: use d suffix on debug object
configure: remove check for libresolve
scripts/make: use $(EXEEXT) for executables
checksrc: got rid of the whitelist files
sendf: added ability to call recv() before send() as workaround
NTLM: check for NULL pointer before dereferencing
openssl: builds with OpenSSL 1.1.0-pre5
configure: ac_cv_ -> curl_cv_ for all cached vars
winbuild: add mbedtls support
curl: make --ftp-create-dirs retry on failure
PolarSSL: implement public key pinning
multi: accidentally used resolved host name instead of proxy
CURLINFO_TLS_SESSION.3: clarify TLS library support before 7.48.0
CONNECT_ONLY: don't close connection on GSS 401/407 reponses
opts: Fix some syntax errors in example code fragments
mbedtls: Fix session resume
test1139: verifies libcurl option man page presence
CURLINFO_TLS_SSL_PTR.3: Clarify SSL pointer availability
curl: make --disable work as long form of -q
curl: use --telnet-option as documented
curl.1: document --ftp-ssl-reqd, --krb4 and --ntlm-wb
curl: -h output lacked --proxy-header and --ntlm-wb
curl -J: make it work even without http:// scheme on URL
lib: include curl_printf.h as one of the last headers
tests: handle path properly on Msys/Cygwin
curl.1: --mail-rcpt can be used multiple times
CURLOPT_ACCEPT_ENCODING.3: clarified
docs: fixed lots of broken man page references
tls: make setting pinnedkey option fail if not supported
test1140: run nroff-scan to verify man pages
http: make sure a blank header overrides accept_decoding
connections: do not reuse non-HTTP proxies on different ports
connect: fix invalid "Network is unreachable" errors
TLS: move the ALPN/NPN enable bits to the connection
TLS: SSL_peek is not a const operation
http2: Add space between colon and header value
darwinssl: fix certificate verification disable on OS X 10.8
mprintf: Fix processing of width and prec args
ftp wildcard: segfault due to init only in multi_perform
|
|
Patch obtained from upstream via OpenBSD ports/net/curl/patches/patch-lib_vtls_openssl_c
|
|
link against nghttp2 library, evidently due to missing entries in the
buildlink3.mk.
From Aleksey Arens in PR 51131.
|
|
|
|
USE_DESTDIR.
|
|
- CURLINFO_TLS_SSL_PTR.3: Warn about limitations
- Revert "sshserver: remove use of AuthorizedKeysFile2"
It seems we may have some autobuild problems after this commit went
in. Trying to see if a revert helps to get them back.
- maketgz: add -j to make dist
... makes it a lot faster
- libcurl-thread.3: minor nroff format fix
- CURLINFO_TLS_SSL_PTR.3: minor nroff format fix
- CODE_STYLE: indend example code
... to make it look nicer in markdown outputa
|
|
|
|
|
|
master site URL accordingly.
|
|
Bugfixes:
* getredirect.c: fix variable name
* tool_doswin: silence unused function warning
* cmake: fixed when OpenSSL enabled on Windows and schannel detected
* curl.1: Explain remote-name behavior if file already exists
* tool_operate: Don't sanitize --output path (Windows)
* URLs: change all http:// URLs to https:// in documentation & comments
* sasl_sspi: Fix memory leak in domain populate
* COPYING: clarify that Daniel is not the sole author
* examples/htmltitle: Use _stricmp on Windows
* examples/asiohiper: Avoid function name collision on Windows
* idn_win32: Better error checking
* openssl: Fix signed/unsigned mismatch warning in X509V3_ext
* curl save files: check for backslashes on cygwin
|
|
|
|
|
|
|
|
-----------------------
Curl and libcurl 7.47.0
Public curl releases: 151
Command line options: 179
curl_easy_setopt() options: 221
Public functions in libcurl: 61
Contributors: 1340
This release includes the following changes:
o version: Add flag CURL_VERSION_PSL for libpsl
o http: added CURL_HTTP_VERSION_2TLS to do HTTP/2 for HTTPS only [8]
o curl: use 2TLS by default
o curl --expect100-timeout: added [10]
o Add .dir-locals and set c-basic-offset to 2 (for emacs) [16]
This release includes the following bugfixes:
o curl: avoid local drive traversal when saving file on Windows [33]
o NTLM: do not resuse proxy connections without diff proxy credentials [34]
o tests: Disable the OAUTHBEARER tests when using a non-default port number [1]
o curl: remove keepalive #ifdef checks done on libcurl's behalf
o formdata: Check if length is too large for memory [2]
o lwip: Fix compatibility issues with later versions [3]
o openssl: BoringSSL doesn't have CONF_modules_free
o config-win32: Fix warning HAVE_WINSOCK2_H undefined
o build: fix compilation error with CURL_DISABLE_VERBOSE_STRINGS [4]
o http2: Fix hanging paused stream [5]
o scripts/Makefile: fix GNUism and survive no perl [6]
o openssl: adapt to 1.1.0+ name changes
o openssl: adapt to openssl >= 1.1.0 X509 opaque structs [7]
o HTTP2.md: spell fix and remove TODO now implemented
o setstropt: const-correctness [9]
o cyassl: fix compiler warning on type conversion
o gskit: Fix host subject altname verification [11]
o http2: Support trailer fields [12]
o wolfssl: handle builds without SSLv3 support
o cyassl: deal with lack of *get_peer_certificate [13]
o sockfilt: do not wait on unreliable file or pipe handle
o make: build zsh script even in an out-of-tree build
o test 1326: fix getting stuck on Windows
o test 87: fix file check on Windows
o configure: allow static builds on mingw [14]
o configure: detect IPv6 support on Windows [15]
o ConnectionExists: with *PIPEWAIT, wait for connections [17]
o Makefile.inc: s/curl_SOURCES/CURL_FILES [18]
o test 16: fixed for Windows
o test 252-255: use datacheck mode text for ASCII-mode LISTings
o tftpd server: add Windows support by writing files in binary mode
o ftplistparser: fix handling of file LISTings using Windows EOL
o tests first.c: fix calculation of sleep timeout on Windows
o tests (several): use datacheck mode text for ASCII-mode LISTings
o CURLOPT_RANGE.3: for HTTP servers, range support is optional
o test 1515: add MSYS support by passing a relative path
o curl_global_init.3: Add Windows-specific info for init via DLL [19]
o http2: Fix client write for trailers on stream close [20]
o mbedtls: Fix ALPN support
o connection reuse: IDN host names fixed [21]
o http2: Fix PUSH_PROMISE headers being treated as trailers [22]
o http2: handle the received SETTINGS frame [23]
o http2: Ensure that http2_handle_stream_close is called [24]
o mbedtls: implement CURLOPT_PINNEDPUBLICKEY
o runtests: Add mbedTLS to the SSL backends
o IDN host names: Remove the port number before converting to ACE [25]
o zsh.pl: fail if no curl is found
o scripts: fix zsh completion generation
o scripts: don't generate and install zsh completion when cross-compiling [26]
o lib: Prefix URLs with lower-case protocol names/schemes [27]
o ConnectionExists: only do pipelining/multiplexing when asked [28]
o configure: assume IPv6 works when cross-compiled [29]
o openssl: for 1.1.0+ they now provide a SSLeay() macro of their own
o openssl: improved error detection/reporting
o ssh: CURLOPT_SSH_PUBLIC_KEYFILE now treats "" as NULL again [30]
o mbedtls: Fix pinned key return value on fail [31]
o maketgz: generate date stamp with LC_TIME=C [32]
This release includes the following known bugs:
o see docs/KNOWN_BUGS (http://curl.haxx.se/docs/knownbugs.html)
This release would not have looked like this without help, code, reports and
advice from friends like these:
Alessandro Ghedini, Anders Bakken, Christian Stewart, Dan Fandrich,
Daniel Schauenberg, Daniel Stenberg, Francisco Moraes, Gisle Vanem,
Isaac Boukris, Johannes Schindelin, John Kohl, Kamil Dudka, Marc Hoersken,
Michael Kaufmann, Mohammad AlSaleh, Patrick Monnerat, Ray Satiro, Steve Holme,
Tatsuhiro Tsujikawa, Thomas Glanzmann, Thomas Klausner,
(21 contributors)
Thanks! (and sorry if I forgot to mention someone)
|
|
Changes:
configure: build silently by default
cookies: Add support for Publix Suffix List with libpsl
vtls: added support for mbedTLS
Added CURLOPT_STREAM_DEPENDS
Added CURLOPT_STREAM_DEPENDS_E
Added CURLOPT_STREAM_WEIGHT
Added CURLFORM_CONTENTLEN
oauth2: Added support for OAUTHBEARER SASL mechanism to IMAP, POP3 and SNMP
Bugfixes:
des: Fix header conditional for Curl_des_set_odd_parity
ntlm: get rid of unconditional use of long long
CURLOPT_CERTINFO.3: fix reference to CURLINFO_CERTINFO
docs: CURLINFO_LASTSOCKET => CURLINFO_ACTIVESOCKET
http2: Fix http2_recv to return -1 if recv returned -1
curl_global_init_mem: set function pointers before doing init
ntlm: error out without 64bit support as the code needs it
openssl: Fix set up of pkcs12 certificate verification chain
acinclude: remove PKGCONFIG override
test1531: case the size to fix the test on non-largefile builds
fread_func: move callback pointer from set to state struct
test1601: fix compilation with --enable-debug and --disable-crypto-auth
http2: Don't pass unitialized name+len pairs to nghttp2_submit_request
curlbuild.h: Fix non-configure compiling to mips and sh4 targets
tool: Generate easysrc with last cache linked-list
cmake: Fix for add_subdirectory(curl) use-case
vtls: fix compiler warning for TLS backends without sha256
build: fix for MSDOS/djgpp
checksrc: add crude // detection
http2: on_frame_recv: trust the conn/data input
ftp: allow CURLOPT_IGNORE_CONTENT_LENGTH to ignore size
polarssl/mbedtls: fix name space pollution
build: Fix mingw ssl gdi32 order
build: Fix support for PKG_CONFIG
MacOSX-Framework: sdk regex fix for sdk 10.10 and later
socks: Fix incorrect port numbers in failed connect messages
curl.1: -E: s/private certificate/client certificate
curl.h: s/HTTPPOST_/CURL_HTTPOST_
curl_formadd: support >2GB files on windows
http redirects: %-encode bytes outside of ascii range
rawstr: Speed up Curl_raw_toupper by 40%
curl_ntlm_core: fix 2 curl_off_t constant overflows.
getinfo: CURLINFO_ACTIVESOCKET: fix bad socket value
tftp tests: verify sent options too
imap: Don't call imap_atom() when no mailbox specified in LIST command
imap: Fixed double quote in LIST command when mailbox contains spaces
imap: Don't check for continuation when executing a CUSTOMREQUEST
acinclude: Remove check for 16-bit curl_off_t
BoringSSL: Work with stricter BIO_get_mem_data()
cmake: Add missing feature macros in config header
sasl_sspi: fixed unicode build for digest authentication
sasl_sspi: fix identity memory leak in digest authentication
unit1602: Fixed failure in torture test
unit1603: Added unit tests for hash functions
vtls/openssl: remove unused traces of yassl ifdefs
openssl: remove #ifdefs for < 0.9.7 support
typecheck-gcc.h: add some missing options
curl: mark two more options strings for --libcurl output
openssl: Free modules on cleanup
CURLMOPT_PUSHFUNCTION.3: *_byname() returns only the first header
getconnectinfo: Don't call recv(2) if socket == -1
http2: http_done: don't free already-freed push headers
zsh completion: Preserve single quotes in output
os400: Provide options for libssh2 use in compile scripts.
build: Fix theoretical infinite loops
pop3: Differentiate between success and continuation responses
examples: Fixed compilation warnings
schannel: Use GetVersionEx() when VerifyVersionInfo() isn't available
CURLOPT_HEADERFUNCTION.3: fix typo
curl: expanded the -XHEAD warning text
done: make sure the final progress update is made
build: Install zsh completion
RTSP: do not add if-modified-since without timecondition
curl: Fixed display of URL index in password prompt for --next
nonblock: fix setting non-blocking mode for Amiga
http2 push: add missing inits of new stream
http2: convert some verbose output into debug-only output
Curl_read_plain: clean up ifdefs that break statements
|
|
Fixed in 7.45.0 - October 7 2015
Changes:
added CURLOPT_DEFAULT_PROTOCOL
added new tool option --proto-default
getinfo: added CURLINFO_ACTIVESOCKET
turned CURLINFO_* option docs as stand-alone man pages
curl: point out unnecessary uses of -X in verbose mode
Bugfixes:
curl_global_init_mem.3: Stronger thread safety warning
buildconf.bat: Fixed issues when ran in directories with special chars
cmake: Fix CurlTests check for gethostbyname_r with 5 arguments
generate.bat: Fixed issues when ran in directories with special chars
generate.bat: Only call buildconf.bat if it exists
generate.bat: Added support for generating only the prerequisite files
curl.1: Document weaknesses in SSLv2 and SSLv3
CURLOPT_HTTP_VERSION.3: connection re-use goes before version
docs: Update the redirect protocols disabled by default
inet_pton.c: Fix MSVC run-time check failure
CURLMOPT_PUSHFUNCTION.3: fix argument types
rtsp: support basic/digest authentication
rtsp: stop reading empty DESCRIBE responses
travis: Upgrading to container based build
travis.yml: Add OS X testbot
FTP: make state machine not get stuck in state
openssl: handle lack of server cert when strict checking disabled
configure: change functions to detect openssl (clones)
configure: detect latest boringssl
runtests: Allow for spaces in server-verify curl custom path
http2: on_frame_recv: get a proper 'conn' for the debug logging
ntlm: mark deliberate switch case fall-through
http2: remove dead code
curl_easy_{escape,unescape}.3: "char *" vs. "const char *"
curl: point out the conflicting HTTP methods if used
cmake: added Windows SSL support
curl_easy_{escape,setopt}.3: fix example
curl_easy_escape.3: escape '\n'
libcurl.m4: Put braces around empty if body
buildconf.bat: Fixed double blank line in 'curl manual' warning output
sasl: Only define Curl_sasl_digest_get_pair() when CRYPTO_AUTH enabled
inet_pton.c: Fix MSVC run-time check failure
CURLOPT_FOLLOWLOCATION.3: mention methods for redirects
http2: don't pass on Connection: headers
nss: do not directly access SSL_ImplementedCiphers
docs: numerous cleanups and spelling fixes
FTP: do_more: add check for wait_data_conn in upload case
parse_proxy: reject illegal port numbers
cmake: IPv6 : disable Unix header check on Windows platform
winbuild: run buildconf.bat if necessary
buildconf.bat: fix syntax error
curl_sspi: fix possibly undefined CRYPT_E_REVOKED
nss: prevent NSS from incorrectly re-using a session
libcurl-errors.3: add two missing error codes
openssl: fix build with < 0.9.8
openssl: refactor certificate parsing to use OpenSSL memory BIO
openldap: only part of LDAP query results received
ssl: add server cert's "sha256//" hash to verbose
NTLM: Reset auth-done when using a fresh connection
curl: generate easysrc only on --libcurl
tests: disable 1801 until fixed
CURLINFO_TLS_SESSION: always return backend info
gnutls: Support CURLOPT_KEYPASSWD
gnutls: Report actual GnuTLS error message for certificate errors
tests: disable 1510 due to CI-problems on github
cmake: Put "winsock2.h" before "windows.h" during configure checks
cmake: Ensure discovered include dirs are considered
configure: Add missing ')' for CURL_CHECK_OPTION_RT
build: fix failures with -Wcast-align and -Werror
FTP: fix uploading ASCII with unknown size
readwrite_data: set a max number of loops
http2: avoid superfluous Curl_expire() calls
http2: set TCP_NODELAY unconditionally
docs: fix unescaped '\n' in man pages
openssl: Fix algorithm init to make (gost) engines work
win32: make recent Borland compilers use long long
runtests: Fix pid check in checkdied
gopher: don't send NUL byte
tool_setopt: fix c_escape truncated octal
hiperfifo: fix the pointer passed to WRITEDATA
getinfo: Fix return code for unknown CURLINFO options
|
|
Curl and libcurl 7.44.0
Public curl releases: 148
Command line options: 176
curl_easy_setopt() options: 219
Public functions in libcurl: 58
Contributors: 1291
This release includes the following changes:
o http2: added CURLMOPT_PUSHFUNCTION and CURLMOPT_PUSHDATA [6]
o examples: added http2-serverpush.c [7]
o http2: added curl_pushheader_byname() and curl_pushheader_bynum()
o docs: added CODE_OF_CONDUCT.md [8]
o curl: Add --ssl-no-revoke to disable certificate revocation checks [5]
o libcurl: New value CURLSSLOPT_NO_REVOKE for CURLOPT_SSL_OPTIONS [9]
o makefile: Added support for VC14
o build: Added Visual Studio 2015 (VC14) project files
o build: Added wolfSSL configurations to VC10+ project files [18]
This release includes the following bugfixes:
o FTP: fix HTTP CONNECT logic regression [1]
o openssl: Fix build with openssl < ~ 0.9.8f
o openssl: fix build with BoringSSL
o curl_easy_setopt.3: option order doesn't matter
o openssl: fix use of uninitialized buffer [2]
o RTSP: removed dead code
o Makefile.m32: add support for CURL_LDFLAG_EXTRAS
o curl: always provide negotiate/kerberos options
o cookie: Fix bug in export if any-domain cookie is present
o curl_easy_setopt.3: mention CURLOPT_PIPEWAIT
o INSTALL: Advise use of non-native SSL for Windows <= XP
o tool_help: fix --tlsv1 help text to use >= for TLSv1
o HTTP: POSTFIELDSIZE set after added to multi handle [3]
o SSL-PROBLEMS: mention WinSSL problems in WinXP
o setup-vms.h: Symbol case fixups
o SSL: Pinned public key hash support
o libtest: call PR_Cleanup() on exit if NSPR is used
o ntlm_wb: Fix theoretical memory leak
o runtests: Allow for spaces in curl custom path
o http2: add stream != NULL checks for reliability
o schannel: Replace deprecated GetVersion with VerifyVersionInfo
o http2: verify success of strchr() in http2_send()
o configure: add --disable-rt option
o openssl: work around MSVC warning
o HTTP: ignore "Content-Encoding: compress"
o configure: check if OpenSSL linking wants -ldl
o build-openssl.bat: Show syntax if required args are missing
o test1902: attempt to make the test more reliable
o libcurl-thread.3: Consolidate thread safety info
o maketgz: Fixed some VC makefiles missing from the release tarball
o libcurl-multi.3: mention curl_multi_wait [10]
o ABI doc: use secure URL
o http: move HTTP/2 cleanup code off http_disconnect() [11]
o libcurl-thread.3: Warn memory functions must be thread safe [12]
o curl_global_init_mem.3: Warn threaded resolver needs thread safe funcs [13]
o docs: formpost needs the full size at start of upload [14]
o curl_gssapi: remove 'const' to fix compiler warnings
o SSH: three state machine fixups [15]
o libcurl.3: fix a single typo [16]
o generate.bat: Only clean prerequisite files when in ALL mode
o curl_slist_append.3: add error checking to the example
o buildconf.bat: Added support for file clean-up via -clean
o generate.bat: Use buildconf.bat for prerequisite file clean-up
o NTLM: handle auth for only a single request [17]
o curl_multi_remove_handle.3: fix formatting [19]
o checksrc.bat: Fixed error when [directory] isn't a curl source directory
o checksrc.bat: Fixed error when missing *.c and *.h files
o CURLOPT_RESOLVE.3: Note removal support was added in 7.42 [20]
o test46: update cookie expire time
o SFTP: fix range request off-by-one in size check [21]
o CMake: fix GSSAPI builds [22]
o build: refer to fixed libidn versions [4]
o http2: discard frames with no SessionHandle [23]
o curl_easy_recv.3: fix formatting
o libcurl-tutorial.3: fix formatting [24]
o curl_formget.3: correct return code [25]
|
|
http://curl.haxx.se/mail/lib-2015-06/0122.html found in
https://github.com/bagder/curl/commit/903b6e05565bf826b4194447864288642214b094
|
|
http://mail-index.netbsd.org/tech-pkg/2015/06/29/msg015105.html
|
|
Curl and libcurl 7.43.0
Public curl releases: 147
Command line options: 176
curl_easy_setopt() options: 219
Public functions in libcurl: 58
Contributors: 1291
This release includes the following changes:
o Added CURLOPT_PROXY_SERVICE_NAME[11]
o Added CURLOPT_SERVICE_NAME[12]
o New curl option: --proxy-service-name[13]
o Mew curl option: --service-name [14]
o New curl option: --data-raw [5]
o Added CURLOPT_PIPEWAIT [15]
o Added support for multiplexing transfers using HTTP/2, enable this
with the new CURLPIPE_MULTIPLEX bit for CURLMOPT_PIPELINING [16]
o HTTP/2: requires nghttp2 1.0.0 or later
o scripts: add zsh.pl for generating zsh completion
o curl.h: add CURL_HTTP_VERSION_2
This release includes the following bugfixes:
o CVE-2015-3236: lingering HTTP credentials in connection re-use [30]
o CVE-2015-3237: SMB send off unrelated memory contents [31]
o nss: fix compilation failure with old versions of NSS [1]
o curl_easy_getinfo.3: document 'internals' in CURLINFO_TLS_SESSION
o schannel.c: Fix possible SEC_E_BUFFER_TOO_SMALL error
o Curl_ossl_init: load builtin modules [2]
o configure: follow-up fix for krb5-config [3]
o sasl_sspi: Populate domain from the realm in the challenge [4]
o netrc: support 'default' token
o README: convert to UTF-8
o cyassl: Implement public key pinning
o nss: implement public key pinning for NSS backend
o mingw build: add arch -m32/-m64 to LDFLAGS
o schannel: Fix out of bounds array [6]
o configure: remove autogenerated files by autoconf
o configure: remove --automake from libtoolize call
o acinclude.m4: fix shell test for default CA cert bundle/path
o schannel: fix regression in schannel_recv [7]
o openssl: skip trace outputs for ssl_ver == 0 [8]
o gnutls: properly retrieve certificate status
o netrc: Read in text mode when cygwin [9]
o winbuild: Document the option used to statically link the CRT [10]
o FTP: Make EPSV use the control IP address rather than the original host
o FTP: fix dangling conn->ip_addr dereference on verbose EPSV
o conncache: keep bundles on host+port bases, not only host names
o runtests.pl: use 'h2c' now, no -14 anymore
o curlver: introducing new version number (checking) macros
o openssl: boringssl build brekage, use SSL_CTX_set_msg_callback [17]
o CURLOPT_POSTFIELDS.3: correct variable names [18]
o curl_easy_unescape.3: update RFC reference [19]
o gnutls: don't fail on non-fatal alerts during handshake
o testcurl.pl: allow source to be in an arbitrary directory
o CURLOPT_HTTPPROXYTUNNEL.3: only works with a HTTP proxy
o SSPI-error: Change SEC_E_ILLEGAL_MESSAGE description [20]
o parse_proxy: switch off tunneling if non-HTTP proxy [21]
o share_init: fix OOM crash
o perl: remove subdir, not touched in 9 years
o CURLOPT_COOKIELIST.3: Add example
o CURLOPT_COOKIE.3: Explain that the cookies won't be modified [22]
o CURLOPT_COOKIELIST.3: Explain Set-Cookie without a domain [23]
o FAQ: How do I port libcurl to my OS?
o openssl: Use TLS_client_method for OpenSSL 1.1.0+
o HTTP-NTLM: fail auth on connection close instead of looping [24]
o curl_setup: Add macros for FOPEN_READTEXT, FOPEN_WRITETEXT [25]
o curl_getdate.3: update RFC reference
o curl_multi_info_read.3: added example
o curl_multi_perform.3: added example
o curl_multi_timeout.3: added example
o cookie: Stop exporting any-domain cookies [26]
o openssl: remove dummy callback use from SSL_CTX_set_verify()
o openssl: remove SSL_get_session()-using code
o openssl: removed USERDATA_IN_PWD_CALLBACK kludge
o openssl: removed error string #ifdef
o openssl: Fix verification of server-sent legacy intermediates [27]
o docs: man page indentation and syntax fixes
o docs: Spelling fixes
o fopen.c: fix a few compiler warnings
o CURLOPT_OPENSOCKETFUNCTION: return error at once [28]
o schannel: Add support for optional client certificates
o build: Properly detect OpenSSL 1.0.2 when using configure
o urldata: store POST size in state.infilesize too [29]
o security:choose_mech remove dead code
o rtsp_do: remove dead code
o docs: many HTTP URIs changed to HTTPS
o schannel: schannel_recv overhaul [32]
This release includes the following known bugs:
o see docs/KNOWN_BUGS (http://curl.haxx.se/docs/knownbugs.html)
This release would not have looked like this without help, code, reports and
advice from friends like these:
Alessandro Ghedini, Alexander Dyagilev, Anders Bakken, Anthony Avina,
Ashish Shukla, Bert Huijben, Brian Chrisman, Brian Prodoehl, Chris Araman,
Dagobert Michelsen, Dan Fandrich, Daniel Melani, Daniel Stenberg,
Dmitry Eremin-Solenikov, Drake Arconis, Egon Eckert, Frank Meier, Fred Stluka,
Gisle Vanem, Grant Pannell, Isaac Boukris, Jens Rantil, Joel Depooter,
Kamil Dudka, Linus Nielsen Feltzing, Linus Nielsen Feltzing Feltzing,
Liviu Chircu, Marc Hoersken, Michael Osipov, Oren Souroujon, Orgad Shaneh,
Patrick Monnerat, Patrick Rapin, Paul Howarth, Paul Oliver, Rafayel Mkrtchyan,
Ray Satiro, Sean Boudreau, Tatsuhiro Tsujikawa, Tomas Tomecek, Viktor Szakáts,
Ville Skyttä, Yehezkel Horowitz,
(43 contributors)
Thanks! (and sorry if I forgot to mention someone)
References to bug reports and discussions on issues:
[1] = http://curl.haxx.se/mail/lib-2015-04/0095.html
[2] = https://github.com/bagder/curl/pull/206
[3] = https://github.com/bagder/curl/commit/5b668606527613179d0349f21b4ab0df2971e3d2#commitcomment-10473445
[4] = https://github.com/bagder/curl/pull/141
[5] = https://github.com/bagder/curl/issues/198
[6] = http://curl.haxx.se/mail/lib-2015-04/0199.html
[7] = https://github.com/bagder/curl/issues/244
[8] = https://github.com/bagder/curl/issues/219
[9] = https://github.com/bagder/curl/pull/258
[10] = https://github.com/bagder/curl/issues/254
[11] = http://curl.haxx.se/libcurl/c/CURLOPT_PROXY_SERVICE_NAME.html
[12] = http://curl.haxx.se/libcurl/c/CURLOPT_SERVICE_NAME.html
[13] = http://curl.haxx.se/docs/manpage.html#--proxy-service-name
[14] = http://curl.haxx.se/docs/manpage.html#--service-name
[15] = http://curl.haxx.se/libcurl/c/CURLOPT_PIPEWAIT.html
[16] = http://curl.haxx.se/libcurl/c/CURLMOPT_PIPELINING.html
[17] = https://github.com/bagder/curl/issues/275
[18] = https://github.com/bagder/curl/issues/281
[19] = https://github.com/bagder/curl/issues/282
[20] = https://github.com/bagder/curl/issues/267
[21] = http://curl.haxx.se/mail/lib-2015-05/0056.html
[22] = http://curl.haxx.se/mail/lib-2015-05/0115.html
[23] = http://curl.haxx.se/mail/lib-2015-05/0137.html
[24] = https://github.com/bagder/curl/issues/256
[25] = https://github.com/bagder/curl/pull/258#issuecomment-107093055
[26] = https://github.com/bagder/curl/issues/292
[27] = https://rt.openssl.org/Ticket/Display.html?id=3621&user=guest&pass=guest
[28] = http://curl.haxx.se/mail/lib-2015-06/0047.html
[29] = http://curl.haxx.se/mail/lib-2015-06/0019.html
[30] = http://curl.haxx.se/docs/adv_20150617A.html
[31] = http://curl.haxx.se/docs/adv_20150617B.html
[32] = https://github.com/bagder/curl/issues/244
|
|
having a PKGNAME of p5-*, or depending such a package,
for perl-5.22.0.
|
|
until the curl interface is updated in 7.43. Bump PKGREVISION.
|
|
Version 7.42.1 (28 Apr 2015)
Daniel Stenberg (28 Apr 2015)
- RELEASE-NOTES: 7.42.1 ready
- CURLOPT_HEADEROPT: default to separate
Make the HTTP headers separated by default for improved security and
reduced risk for information leakage.
Bug: http://curl.haxx.se/docs/adv_20150429.html
Reported-by: Yehezkel Horowitz, Oren Souroujon
- RELEASE-NOTES: synced with a6e0270e
- sws: init http2 state properly
It would otherwise cause problems when running tests after 1801 etc.
- curl_easy_getinfo.3: document 'internals' in CURLINFO_TLS_SESSION
... as it was previouly undocumented what the pointer was.
- openssl: fix serial number output
The code extracting the cert serial number was broken and didn't display
it properly.
Bug: https://github.com/bagder/curl/issues/235
Reported-by: dkjjr89
- [Alessandro Ghedini brought this change]
curl.1: fix typo
- RELEASE-NOTES: toward 7.42.1, synced with 097460a
- [Kamil Dudka brought this change]
curl -z: do not write empty file on unmet condition
This commit fixes a regression introduced in curl-7_41_0-186-g261a0fe.
It also introduces a regression test 1424 based on tests 78 and 1423.
Reported-by: Viktor Szakats
Bug: https://github.com/bagder/curl/issues/237
- [Kamil Dudka brought this change]
docs: distribute the CURLOPT_PINNEDPUBLICKEY(3) man page, too
- connectionexists: follow-up to fd9d3a1ef1f
PROTOPT_CREDSPERREQUEST still needs to be checked even when NTLM is not
enabled.
Mistake-caught-by: Kamil Dudka
- connectionexists: fix build without NTLM
Do not access NTLM-specific struct fields when built without NTLM
enabled!
bug: http://curl.haxx.se/?i=231
Reported-by: Patrick Rapin
- dist: include {src,lib}/checksrc.whitelist
|
|
This release includes the following changes:
o openssl: show the cipher selection to use in verbose text
o gtls: implement CURLOPT_CERTINFO
o add CURLOPT_SSL_FALSESTART option (darwinssl and NSS)
o curl: add --false-start option
o add CURLOPT_PATH_AS_IS
o curl: add --path-as-is option
o curl: create output file on successful download of an empty file
This release includes the following bugfixes:
o ConnectionExists: for NTLM re-use, require credentials to match
o cookie: cookie parser out of boundary memory access
o fix_hostname: zero length host name caused -1 index offset
o http_done: close Negotiate connections when done
o sws: timeout idle CONNECT connections
o nss: improve error handling in Curl_nss_random()
o nss: do not skip Curl_nss_seed() if data is NULL
o curl-config.in: eliminate double quotes around CURL_CA_BUNDLE
o http2: move lots of verbose output to be debug-only
o dist: add extern-scan.pl to the tarball
o http2: return recv error on unexpected EOF
o build: Use default RandomizedBaseAddress directive in VC9+ project files
o build: Removed DataExecutionPrevention directive from VC9+ project files
o tool: Updated the warnf() function to use the GlobalConfig structure
o http2: Return error if stream was closed with other than NO_ERROR
o mprintf.h: remove #ifdef CURLDEBUG
o libtest: fixed linker errors on msvc
o tool: use ENABLE_CURLX_PRINTF instead of _MPRINTF_REPLACE
o curl.1: fix "The the" typo
o cmake: handle build definitions CURLDEBUG/DEBUGBUILD
o openssl: remove all uses of USE_SSLEAY
o multi: fix memory-leak on timeout (regression)
o curl_easy_setopt.3: added CURLOPT_SSL_VERIFYSTATUS
o metalink: add some error checks
o TLS: make it possible to enable ALPN/NPN without HTTP/2
o http2: use CURL_HTTP_VERSION_* symbols instead of NPN_*
o conncontrol: only log changes to the connection bit
o multi: fix *getsock() with CONNECT
o symbols.pl: handle '-' in the deprecated field
o MacOSX-Framework: use @rpath instead of @executable_path
o GnuTLS: add support for CURLOPT_CAPATH
o GnuTLS: print negotiated TLS version and full cipher suite name
o GnuTLS: don't print double newline after certificate dates
o memanalyze.pl: handle free(NULL)
o proxy: re-use proxy connections (regression)
o mk-ca-bundle: Don't report SHA1 numbers with "-q"
o http: always send Host: header as first header
o openssl: sort ciphers to use based on strength
o openssl: use colons properly in the ciphers list
o http2: detect premature close without data transfered
o hostip: Fix signal race in Curl_resolv_timeout
o closesocket: call multi socket cb on close even with custom close
o mksymbolsmanpage.pl: use std header and generate better nroff header
o connect: Fix happy eyeballs logic for IPv4-only builds
o curl_easy_perform.3: remove superfluous close brace from example
o HTTP: don't use Expect: headers when on HTTP/2
o Curl_sh_entry: remove unused 'timestamp'
o docs/libcurl: makefile portability fix
o mkhelp: Remove trailing carriage return from every line of input
o nss: explicitly tell NSS to disable NPN/ALPN when libcurl disables it
o curl_easy_setopt.3: added a few missing options
o metalink: fix resource leak in OOM
o axtls: version 1.5.2 now requires that config.h be manually included
o HTTP: don't switch to HTTP/2 from 1.1 until we get the 101
o cyassl: detect the library as renamed wolfssl
o CURLOPT_HTTPHEADER.3: add a "SECURITY CONCERNS" section
o CURLOPT_URL.3: Added "SECURITY CONCERNS
o openssl: try to avoid accessing OCSP structs when possible
o test938: added missing closing tags
o testcurl: Allow '=' in values given on command line
o tests/certs: added make target to rebuild certificates
o tests/certs: rebuild certificates with modified key usage bits
o gtls: avoid uninitialized variable
o gtls: dereferencing NULL pointer
o gtls: add check of return code
o test1513: eliminated race condition in test run
o dict: rename byte to avoid compiler shadowed declaration warning
o curl_easy_recv/send: make them work with the multi interface
o vtls: fix compile with --disable-crypto-auth but with SSL
o openssl: adapt to ASN1/X509 things gone opaque in 1.1
o openssl: verifystatus: only use the OCSP work-around <= 1.0.2a
o curl_memory: make curl_memory.h the second-last header file loaded
o testcurl.pl: add the --notes option to supply more info about a build
o cyassl: If wolfSSL then identify as such in version string
o cyassl: Check for invalid length parameter in Curl_cyassl_random
o cyassl: default to highest possible TLS version
o Curl_ssl_md5sum: return CURLcode (fixes OOM)
o polarssl: remove dead code
o polarssl: called mbedTLS in 1.3.10 and later
o globbing: fix step parsing for character globbing ranges
o globbing: fix url number calculation when using range with step
o multi: on a request completion, check all CONNECT_PEND transfers
o build: link curl to openssl libraries when openssl support is enabled
o url: Don't accept CURLOPT_SSLVERSION unless USE_SSL is defined
o vtls: Don't accept unknown CURLOPT_SSLVERSION values
o build: Fix libcurl.sln erroneous mixed configurations
o cyassl: remove undefined reference to CyaSSL_no_filesystem_verify
o cyassl: add SSL context callback support for CyaSSL
o tool: only set SSL options if SSL is enabled
o multi: remove_handle: move pending connections
o configure: Use KRB5CONFIG for krb5-config
o axtls: add timeout within Curl_axtls_connect
o CURLOPT_HTTP200ALIASES.3: Mainly SHOUTcast servers use "ICY 200"
o cyassl: Fix library initialization return value
o cookie: handle spaces after the name in Set-Cookie
o http2: Fix missing nghttp2_session_send call in Curl_http2_switched
o cyassl: Fix certificate load check
o build-openssl.bat: Fix mixed line endings
o checksrc.bat: Check lib\vtls source
o DNS: fix refreshing of obsolete dns cache entries
o CURLOPT_RESOLVE: actually implement removals
o checksrc.bat: quotes to support an SRC_DIR with spaces
o cyassl: Remove 'Connecting to' message from cyassl_connect_step2
o cyassl: Use CYASSL_MAX_ERROR_SZ for error buffer size
o lib/transfer.c: Remove factor of 8 from sleep time calculation
o lib/makefile.m32: add missing libs to build libcurl.dll
o build: Generate source prerequisites for Visual Studio in generate.bat
o cyassl: Include the CyaSSL build config
o firefox-db2pem: fix wildcard to find Firefox default profile
o BUGS: refer to the github issue tracker now as primary
o vtls_openssl: improve several certificate error messages
o cyassl: Add support for TLS extension SNI
o parsecfg: do not continue past a zero termination
o configure --with-nss=PATH: query pkg-config if available
o configure --with-nss: drop redundant if statement
o cyassl: Fix include order
o HTTP: fix PUT regression with Negotiate
o curl_version_info.3: fixed the 'protocols' variable type
|
|
|
|
Version 7.41.0 (25 Feb 2015)
Daniel Stenberg (25 Feb 2015)
- THANKS: added contributors from the 7.41.0 RELEASE-NOTES
- RELEASE-NOTES: sync with ffc2aeec6e (7.41.0 release time!)
Marc Hoersken (25 Feb 2015)
- Revert "telnet.c: fix handling of 0 being returned from custom read function"
This reverts commit 03fa576833643c67579ae216c4e7350fa9b5f2fe.
- telnet.c: fix invalid use of custom read function if not being set
obj_count can be 1 if the custom read function is set or the stdin
handle is a reference to a pipe. Since the pipe should be handled
using the PeekNamedPipe-check below, the custom read function should
only be used if it is actually enabled.
- telnet.c: fix handling of 0 being returned from custom read function
According to [1]: "Returning 0 will signal end-of-file to the library
and cause it to stop the current transfer."
This change makes the Windows telnet code handle this case accordingly.
[1] http://curl.haxx.se/libcurl/c/CURLOPT_READFUNCTION.html
Daniel Stenberg (24 Feb 2015)
- sws: stop logging about TPC_NODELAY nonsense
- lib530: make it less timing sensible
... by making sure the first request is completed before doing the
remainder.
Kamil Dudka (23 Feb 2015)
- connect: wait for IPv4 connection attempts
... even if the last IPv6 connection attempt has failed.
Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1187531#c4
- connect: avoid skipping an IPv4 address
... in case the protocol versions are mixed in a DNS response
(IPv6 -> IPv4 -> IPv6).
Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1187531#c3
Daniel Stenberg (23 Feb 2015)
- RELEASE-NOTES: synced with 5e4395eab839d
- ROADMAP: curl_easy_setopt.3 has already been split up
Remove cmake as marked for removal. It is in much better state now.
- ROADMAP: extend the HTTP/2 stuff, remove SPDY
- [Julian Ospald brought this change]
configure: allow both --with-ca-bundle and --with-ca-path
SSL_CTX_load_verify_locations by default (and if given non-Null
parameters) searches the CAfile first and falls back to CApath. This
allows for CAfile to be a basis (e.g. installed by the package manager)
and CApath to be a user configured directory.
This wasn't reflected by the previous configure constraint which this
patch fixes.
Bug: https://github.com/bagder/curl/pull/139
- [Ben Boeckel brought this change]
cmake: install the dll file to the correct directory
- [Alessandro Ghedini brought this change]
nss: fix NPN/ALPN protocol negotiation
Correctly check for memcmp() return value (it returns 0 if the strings match).
This is not really important, since curl is going to use http/1.1 anyway, but
it's still a bug I guess.
- [Alessandro Ghedini brought this change]
polarssl: fix ALPN protocol negotiation
Correctly check for strncmp() return value (it returns 0 if the strings
match).
- [Sergei Nikulov brought this change]
CMake: Fix generation of tool_hugehelp.c on windows
Use "cmake -E echo" instead of "echo".
Reviewed-by: Brad King <brad.king@kitware.com>
- [Sergei Nikulov brought this change]
CMake: fix winsock2 detection on windows
Set CMAKE_REQUIRED_DEFINITIONS to include definitions needed to get
the winsock2 API from windows.h. Simplify the order of checks to
avoid extra conditions.
Use check_include_file instead of check_include_file_concat to look
for OpenSSL headers. They do not need to participate in a sequence
of dependent system headers. Also they may cause winsock.h to be
included before ws2tcpip.h, causing the latter to not be detected
in the sequence.
Reviewed-by: Brad King <brad.king@kitware.com>
- [Alessandro Ghedini brought this change]
gtls: fix build with HTTP2
Steve Holme (16 Feb 2015)
- Makefile.vc6: Corrected typos in rename of darwinssl.obj
Nick Zitzmann (15 Feb 2015)
- By request, change the name of "curl_darwinssl.[ch]" to "darwinssl.[ch]"
Steve Holme (14 Feb 2015)
- RELEASE-NOTES: Synced with 6f89f86c3d
- tests/README: Updated to reflect email test ranges
- [Alessandro Ghedini brought this change]
curl.1: --cert-status is also supported by OpenSSL now
- build: Removed Visual Studio SuppressStartupBanner directive for VC8+
Visual Studio 2005 and above defaults to disabling the startup banner
for the Compiler, Linker and MIDL tools (with /NOLOGO). As such there
is no need to explicitly set the SuppressStartupBanner directive, as
this is a leftover from the VC7 and VC7.1 projects being upgraded to
VC8 and above.
Kamil Dudka (12 Feb 2015)
- openssl: fix a compile-time warning
lib/vtls/openssl.c:1450:7: warning: extra tokens at end of #endif directive
Steve Holme (11 Feb 2015)
- openssl: Use OPENSSL_IS_BORINGSSL for BoringSSL detection
For consistency with other conditionally compiled code in openssl.c,
use OPENSSL_IS_BORINGSSL rather than HAVE_BORINGSSL and try to use
HAVE_BORINGSSL outside of openssl.c when the OpenSSL header files are
not included.
Patrick Monnerat (11 Feb 2015)
- ftp: accept all 2xx responses to the PORT command
Steve Holme (9 Feb 2015)
- openssl: Disable OCSP in old versions of OpenSSL
Versions of OpenSSL prior to v0.9.8h do not support the necessary
functions for OCSP stapling.
Daniel Stenberg (9 Feb 2015)
- [Tatsuhiro Tsujikawa brought this change]
http2: Fix bug that associated stream canceled on PUSH_PROMISE
Previously we don't ignore PUSH_PROMISE header fields in on_header
callback. It makes header values mixed with following HEADERS,
resulting protocol error.
- [Jay Satiro brought this change]
polarssl: Fix exclusive SSL protocol version options
Prior to this change the options for exclusive SSL protocol versions did
not actually set the protocol exclusive.
http://curl.haxx.se/mail/lib-2015-01/0002.html
Reported-by: Dan Fandrich
- [Jay Satiro brought this change]
gskit: Fix exclusive SSLv3 option
- curl.1: clarify that -X is used for all requests
Reported-by: Jon Seymour
- curl.1: add warning when using -H and redirects
Steve Holme (7 Feb 2015)
- schannel: Removed curl_ prefix from source files
Removed the curl_ prefix from the schannel source files as discussed
with Marc and Daniel at FOSDEM.
Daniel Stenberg (6 Feb 2015)
- md5: use axTLS's own MD5 functions when available
- MD(4|5): make the MD4_* and MD5_* functions static
- axtls: fix conversion from size_t to int warning
Steve Holme (5 Feb 2015)
- ftp: Use 'CURLcode result' for curl result codes
Daniel Stenberg (5 Feb 2015)
- openssl: SSL_SESSION->ssl_version no longer exist
The struct went private in 1.0.2 so we cannot read the version number
from there anymore. Use SSL_version() instead!
Reported-by: Gisle Vanem
Bug: http://curl.haxx.se/mail/lib-2015-02/0034.html
Dan Fandrich (4 Feb 2015)
- unit1600: Fix compilation when NTLM is disabled
Daniel Stenberg (4 Feb 2015)
- MD5: fix compiler warnings and code style nits
- MD5: replace implementation
The previous one was "encumbered" by RSA Inc - to avoid the licensing
restrictions it has being replaced. This is the initial import,
inserting the md5.c and md5.h files from
http://openwall.info/wiki/people/solar/software/public-domain-source-code/md5
Code-by: Alexander Peslyak
- MD4: fix compiler warnings and code style nits
- MD4: replace implementation
The previous one was "encumbered" by RSA Inc - to avoid the licensing
restrictions it has being replaced. This is the initial import,
inserting the md4.c and md4.h files from
http://openwall.info/wiki/people/solar/software/public-domain-source-code/md4
Code-by: Alexander Peslyak
Steve Holme (4 Feb 2015)
- telnet: Prefer 'CURLcode result' for curl result codes
- hostasyn: Prefer 'CURLcode result' for curl result codes
- schannel: Prefer 'CURLcode result' for curl result codes
Daniel Stenberg (3 Feb 2015)
- unit1601: MD5 unit tests
- unit1600: unit test for Curl_ntlm_core_mk_nt_hash
- unit1600: NTLM unit test
- tests/README: add a new range, clean up some language
- [Jay Satiro brought this change]
opts: CURLOPT_CAINFO availability depends on SSL engine
- getpass: protect include with proper #ifdef
Reported-by: Tamir
- getpass_r: read from stdin, not stdout!
The file number used was wrong. This bug was introduced over 10 years
ago, proving this function isn't used much...
Bug: http://curl.haxx.se/bug/view.cgi?id=1476
Reported-by: Tamir
- test1135: verify the CURL_EXTERN order in header files
- Makefile.am: fix 'make distcheck'
... by removing generated files from the *_DIST variable [*] and instead
generate them with a .dist suffix, since that is then handled and put
into the release archive by our generic dist-hook.
[*] = 'make distcheck' fails with non-existing files listed there
Steve Holme (2 Feb 2015)
- curl_sasl.c: More code policing
Better use of 80 character line limit, comment corrections and line
spacing preferences.
Daniel Stenberg (2 Feb 2015)
- libcurl-symbols: first basic shot for autogenerated docs
- FAQ: minor edit of 3.22
Steve Holme (2 Feb 2015)
- build: Added removal of Visual Studio project files
Added the removal of the locally generated project files so one
may revert to a clean repository.
- build: Renamed top level Visual Studio solution files
In preparation for adding the test suite and examples projects renamed
the top level "all" solution files to better describe what they are.
This will also enable us to use "curl" rather than "curlsrc" for the
command line tool solution and project files, which will simplify some
of the configuration.
- build: Enabled DEBUGBUILD in Visual Studio debug builds
Defined the DEBUGBUILD pre-processor variable to allow extra logging,
which is particularly useful in debug builds, as we use this and Visual
Studio typically uses _DEBUG.
We could define DEBUBBUILD, in curl_setup.h, when _MSC_VER and _DEBUG is
defined but that would also affect the makefile based builds which we
probably don't want to do.
- build: Removed unused Visual Studio bscmake settings
Daniel Stenberg (2 Feb 2015)
- CURLOPT_HTTP_VERSION.3: CURL_HTTP_VERSION_2_0 added in 7.33.0
And modify the text to refer to HTTP 2 as it isn't called "2.0".
Reported-By: Michael Wallner
Marc Hoersken (31 Jan 2015)
- TODO: moved WinSSL/SChannel todo items into docs
Daniel Stenberg (29 Jan 2015)
- [Michael Kaufmann brought this change]
CURLOPT_SEEKFUNCTION.3: also when server closes a connection
Steve Holme (29 Jan 2015)
- curl_sasl.c: Fixed compilation warning when cryptography is disabled
curl_sasl.c:1506: warning: unused variable 'chlg'
- curl_sasl.c: Fixed compilation warning when verbose debug output disabled
curl_sasl.c:1317: warning: unused parameter 'conn'
- ntlm_core: Use own odd parity function when crypto engine doesn't have one
- ntlm_core: Prefer sizeof(key) rather than hard coded sizes
- ntlm_core: Added consistent comments to DES functions
- des: Added Curl_des_set_odd_parity()
Added Curl_des_set_odd_parity() for use when cryptography engines
don't include this functionality.
- tests: Grouped SMTP SASL EXTERNAL tests with other SMTP tests
- tests: Grouped POP3 SASL EXTERNAL tests with other POP3 tests
- tests: Grouped IMAP SASL EXTERNAL tests with other IMAP tests
- sasl: Minor code policing and grammar corrections
Daniel Stenberg (28 Jan 2015)
- [Gisle Vanem brought this change]
ldap: build with BoringSSL
- security: avoid compiler warning
Possible access to uninitialised memory '&nread' at line 140 of
lib/security.c in function 'ftp_send_command'.
Reported-by: Rich Burridge
- runtests: identify BoringSSL and libressl
Patrick Monnerat (27 Jan 2015)
- docs: cite SASL external authentication.
- sasl: remove XOAUTH2 from default enabled authentication mechanism.
- test: add test cases for sasl external authentication (imap/pop3/smtp).
- imap: remove automatic password setting: it breaks external sasl authentication
- sasl: implement EXTERNAL authentication mechanism.
Its use is only enabled by explicit requirement in URL (;AUTH=EXTERNAL) and
by not setting the password.
Steve Holme (27 Jan 2015)
- openssl: Fixed Curl_ossl_cert_status_request() not returning FALSE
Modified the Curl_ossl_cert_status_request() function to return FALSE
when built with BoringSSL or when OpenSSL is missing the necessary TLS
extensions.
- openssl: Fixed compilation errors when OpenSSL built with 'no-tlsext'
Fixed the build of openssl.c when OpenSSL is built without the necessary
TLS extensions for OCSP stapling.
Reported-by: John E. Malmberg
- [Brad Spencer brought this change]
curl_setup: Disable SMB/CIFS support when HTTP only
- RELEASE-NOTES: Synced with 37824498a3
Daniel Stenberg (22 Jan 2015)
- configure: remove detection of the old yassl emulation API
... as that is ancient history and not used.
- OCSP stapling: disabled when build with BoringSSL
- [Alessandro Ghedini brought this change]
openssl: add support for the Certificate Status Request TLS extension
Also known as "status_request" or OCSP stapling, defined in RFC6066
section 8.
Thanks-to: Joe Mason
- for the work-around for the OpenSSL bug.
- BoringSSL: fix build for non-configure builds
HAVE_BORINGSSL gets defined now by configure and should be defined by
other build systems in case a BoringSSL build is desired.
- configure: fix BoringSSL detection and detect libresssl
Steve Holme (22 Jan 2015)
- curl_sasl: Reinstate the sasl_ prefix for locally scoped functions
Commit 7a8b2885e2 made some functions static and removed the public
Curl_ prefix. Unfortunately, it also removed the sasl_ prefix, which
is the naming convention we use in this source file.
- curl_sasl: Minor code policing following recent commits
Daniel Stenberg (22 Jan 2015)
- [John Malmberg brought this change]
openvms: Handle openssl/0.8.9zb version parsing
packages/vms/gnv_link_curl.com was assuming only a single letter suffix
in the openssl version. That assumption has been fixed for 7.40.
- BoringSSL: detected by configure, switches off NTLM
- BoringSSL: no PKCS12 support nor ERR_remove_state
- [Leith Bade brought this change]
BoringSSL: fix build
Steve Holme (20 Jan 2015)
- curl_sasl.c: chlglen is not used when cryptography is disabled
- curl_sasl.c: Fixed compilation warning when cyptography is disabled
curl_sasl.c:1453: warning C4101: 'serverdata' : unreferenced local
variable
- curl_sasl.c: Fixed compilation error when USE_WINDOWS_SSPI defined
curl_sasl.c:1221: error C2065: 'mechtable' : undeclared identifier
This error could also happen for non-SSPI builds when cryptography is
disabled (CURL_DISABLE_CRYPTO_AUTH is defined).
Patrick Monnerat (20 Jan 2015)
- SASL: make some procedures local-scoped
- SASL: common state engine for imap/pop3/smtp
- SASL: common URL option and auth capabilities decoders for all protocols
- IMAP/POP3/SMTP: use a per-connection sub-structure for SASL parameters.
Daniel Stenberg (20 Jan 2015)
- ipv6: enclose AF_INET6 uses with proper #ifdefs for ipv6
Reported-by: Chris Young
- [Chris Young brought this change]
timeval: typecast for better type (on Amiga)
There is an issue with conflicting "struct timeval" definitions with
certain AmigaOS releases and C libraries, depending on what gets
included when. It's a minor difference - the OS one is unsigned,
whereas the common structure has signed elements. If the OS one ends up
getting defined, this causes a timing calculation error in curl.
It's easy enough to resolve this at the curl end, by casting the
potentially errorneous calculation to a signed long.
- openssl: do public key pinning check independently
... of the other cert verification checks so that you can set verifyhost
and verifypeer to FALSE and still check the public key.
Bug: http://curl.haxx.se/bug/view.cgi?id=1471
Reported-by: Kyle J. McKay
Patrick Monnerat (19 Jan 2015)
- OS400: CURLOPT_SSL_VERIFYSTATUS for ILE/RPG too.
Steve Holme (18 Jan 2015)
- ldap: Renamed the CURL_LDAP_WIN definition to USE_WIN32_LDAP
For consistency with other USE_WIN32_ defines as well as the
USE_OPENLDAP define.
- http_negotiate: Use dynamic buffer for SPN generation
Use a dynamicly allocated buffer for the temporary SPN variable similar
to how the SASL GSS-API code does, rather than using a fixed buffer of
2048 characters.
- sasl_gssapi: Make Curl_sasl_build_gssapi_spn() public
- sasl_gssapi: Fixed memory leak with local SPN variable
Daniel Stenberg (17 Jan 2015)
- http_negotiate.c: unused variable 'ret'
Steve Holme (17 Jan 2015)
- gskit.h: Code policing of function pointer arguments
- vtls: Removed unimplemented overrides of curlssl_close_all()
Carrying on from commit 037cd0d991, removed the following unimplemented
instances of curlssl_close_all():
Curl_axtls_close_all()
Curl_darwinssl_close_all()
Curl_cyassl_close_all()
Curl_gskit_close_all()
Curl_gtls_close_all()
Curl_nss_close_all()
Curl_polarssl_close_all()
- vtls: Separate the SSL backend definition from the API setup
Slight code cleanup as the SSL backend #define is mixed up with the API
function setup.
- vtls: Fixed compilation errors when SSL not used
Fixed the following warning and error from commit 3af90a6e19 when SSL
is not being used:
url.c:2004: warning C4013: 'Curl_ssl_cert_status_request' undefined;
assuming extern returning int
error LNK2019: unresolved external symbol Curl_ssl_cert_status_request
referenced in function Curl_setopt
- http_negotiate: Added empty decoded challenge message info text
- http_negotiate: Return CURLcode in Curl_input_negotiate() instead of int
- http_negotiate_sspi: Prefer use of 'attrs' for context attributes
Use the same variable name as other areas of SSPI code.
- http_negotiate_sspi: Use correct return type for QuerySecurityPackageInfo()
Use the SECURITY_STATUS typedef rather than a unsigned long for the
QuerySecurityPackageInfo() return and rename the variable as per other
areas of SSPI code.
- http_negotiate_sspi: Use 'CURLcode result' for CURL result code
- curl_endian: Fixed build when 64-bit integers are not supported (Part 2)
Missed Curl_read64_be() in commit bb12d44471 :(
Daniel Stenberg (16 Jan 2015)
- CURLOPT_SSL_VERIFYSTATUS.3: mention it is added in version 7.41.0
- curlver.h: next release is 7.41.0 due to the changes
- RELEASE-NOTES: mention the new OCSP stapling options, bump version
- opts: add CURLOPT_SSL_VERIFYSTATUS* to docs/Makefile
- help: add --cert-status to --help output
- copyright years: after OCSP stapling changes
- [Alessandro Ghedini brought this change]
curl: add --cert-status option
This enables the CURLOPT_SSL_VERIFYSTATUS functionality.
- [Alessandro Ghedini brought this change]
nss: add support for the Certificate Status Request TLS extension
Also known as "status_request" or OCSP stapling, defined in RFC6066 section 8.
This requires NSS 3.15 or higher.
- [Alessandro Ghedini brought this change]
gtls: add support for the Certificate Status Request TLS extension
Also known as "status_request" or OCSP stapling, defined in RFC6066 section 8.
This requires GnuTLS 3.1.3 or higher to build, however it's recommended to use
at least GnuTLS 3.3.11 since previous versions had a bug that caused the OCSP
response verfication to fail even on valid responses.
- [Alessandro Ghedini brought this change]
url: add CURLOPT_SSL_VERIFYSTATUS option
This option can be used to enable/disable certificate status verification using
the "Certificate Status Request" TLS extension defined in RFC6066 section 8.
This also adds the CURLE_SSL_INVALIDCERTSTATUS error, to be used when the
certificate status verification fails, and the Curl_ssl_cert_status_request()
function, used to check whether the SSL backend supports the status_request
extension.
- TheArtOfHttpScripting: skip the date at the top, we have git
- TheArtOfHttpScripting: phrase it TLS lib agnostic
Steve Holme (16 Jan 2015)
- TODO: Added some SMB ideas
- RELEASE-NOTES: Synced with 5f09947d28
- build-openssl.bat: Added check for Perl installation
- checksrc.bat: Better detection of Perl installation
- curl_endian: Fixed build when 64-bit integers are not supported
Bug: http://curl.haxx.se/mail/lib-2015-01/0094.html
Reported-by: John E. Malmberg
Daniel Stenberg (15 Jan 2015)
- [Yun SangHo brought this change]
curl.h: remove extra space
- Curl_pretransfer: reset expected transfer sizes
Reported-by: Mohammad AlSaleh
Bug: http://curl.haxx.se/mail/lib-2015-01/0065.html
Marc Hoersken (12 Jan 2015)
- curl_schannel.c: mark session as removed from cache if not freed
If the session is still used by active SSL/TLS connections, it
cannot be closed yet. Thus we mark the session as not being cached
any longer so that the reference counting mechanism in
Curl_schannel_shutdown is used to close and free the session.
Reported-by: Jean-Francois Durand
Steve Holme (9 Jan 2015)
- RELEASE-NOTES: Synced with d21b66835f
Guenter Knauf (9 Jan 2015)
- Merge pull request #134 from vszakats/mingw-m64
add -m64 CFLAGS when targeting mingw64, add -m32/-m64 to LDFLAGS
- Merge pull request #136 from vszakats/mingw-allow-custom-cflags
mingw build: allow to pass custom CFLAGS
Daniel Stenberg (9 Jan 2015)
- NSS: fix compiler error when built http2-enabled
Steve Holme (9 Jan 2015)
- gssapi: Remove need for duplicated GSS_C_NT_HOSTBASED_SERVICE definitions
Better code reuse and consistency in calls to gss_import_name().
Viktor Szakats (9 Jan 2015)
- mingw build: allow to pass custom CFLAGS
Daniel Stenberg (8 Jan 2015)
- FTP: if EPSV fails on IPV6 connections, bail out
... instead of trying PASV, since PASV can't work with IPv6.
Reported-by: Vojtěch Král
- FTP: fix IPv6 host using link-local address
... and make sure we can connect the data connection to a host name that
is longer than 48 bytes.
Also simplifies the code somewhat by re-using the original host name
more, as it is likely still in the DNS cache.
Original-Patch-by: Vojtěch Král
Bug: http://curl.haxx.se/bug/view.cgi?id=1468
Steve Holme (8 Jan 2015)
- [Sam Schanken brought this change]
winbuild: Added option to build with c-ares
Added support for a WITH_CARES option to be used when invoking nmake
via Makefile.vc. This option enables linking against both the DLL and
static versions of the c-ares libraries, as well as the debug and
release varients, depending on the value of DEBUG. The USE_ARES
preprocessor symbol is also defined.
Guenter Knauf (8 Jan 2015)
- NetWare build: added TLS-SRP enabled build.
Steve Holme (8 Jan 2015)
- sasl_gssapi: Fixed build on NetBSD with built-in GSS-API
Bug: http://curl.haxx.se/bug/view.cgi?id=1469
Reported-by: Thomas Klausner
Viktor Szakats (8 Jan 2015)
- add -m64 clags when targeting mingw64, add -m32/-m64 to LDFLAGS
Daniel Stenberg (8 Jan 2015)
- bump: start working towards 7.40.1
- THANKS: 14 new contributors from the 7.40.0 release notes
|
|
|
|
compile any longer, see
https://sourceforge.net/p/curl/bugs/1469/
Changes:
Curl and libcurl 7.40.0
Public curl releases: 143
Command line options: 162
curl_easy_setopt() options: 208
Public functions in libcurl: 58
Contributors: 1219
This release includes the following changes:
o http_digest: Added support for Windows SSPI based authentication
o version info: Added Kerberos V5 to the supported features
o Makefile: Added VC targets for WinIDN
o config-win32: Introduce build targets for VS2012+
o SSL: Add PEM format support for public key pinning
o smtp: Added support for the conversion of Unix newlines during mail send [8]
o smb: Added initial support for the SMB/CIFS protocol
o Added support for HTTP over unix domain sockets, via
CURLOPT_UNIX_SOCKET_PATH and --unix-socket
o sasl: Added support for GSS-API based Kerberos V5 authentication
This release includes the following bugfixes:
o darwinssl: fix session ID keys to only reuse identical sessions [18]
o url-parsing: reject CRLFs within URLs [19]
o OS400: Adjust specific support to last release
o THANKS: Remove duplicate names
o url.c: Fixed compilation warning
o ssh: Fixed build on platforms where R_OK is not defined [1]
o tool_strdup.c: include the tool strdup.h
o build: Fixed Visual Studio project file generation of strdup.[c|h]
o curl_easy_setopt.3: add CURLOPT_PINNEDPUBLICKEY [2]
o curl.1: show zone index use in a URL
o mk-ca-bundle.vbs: switch to new certdata.txt url
o Makefile.dist: Added some missing SSPI configurations
o build: Fixed no NTLM support for email when CURL_DISABLE_HTTP is defined
o SSH: use the port number as well for known_known checks [3]
o libssh2: detect features based on version, not configure checks
o http2: Deal with HTTP/2 data inside Upgrade response header buffer [4]
o multi: removed Curl_multi_set_easy_connection
o symbol-scan.pl: do not require autotools
o cmake: add ENABLE_THREADED_RESOLVER, rename ARES
o cmake: build libhostname for test suite
o cmake: fix HAVE_GETHOSTNAME definition
o tests: fix libhostname visibility
o tests: fix memleak in server/resolve.c
o vtls.h: Fixed compiler warning when compiled without SSL
o CMake: Restore order-dependent header checks
o CMake: Restore order-dependent library checks
o tool: Removed krb4 from the supported features
o http2: Don't send Upgrade headers when we already do HTTP/2
o examples: Don't call select() to sleep on windows [6]
o win32: Updated some legacy APIs to use the newer extended versions [5]
o easy.c: Fixed compilation warning when no verbose string support
o connect.c: Fixed compilation warning when no verbose string support
o build: in Makefile.m32 pass -F flag to windres
o build: in Makefile.m32 add -m32 flag for 32bit
o multi: when leaving for timeout, close accordingly
o CMake: Simplify if() conditions on check result variables
o build: in Makefile.m32 try to detect 64bit target
o multi: inform about closed sockets before they are closed
o multi-uv.c: close the file handle after download
o examples: Wait recommended 100ms when no file descriptors are ready
o ntlm: Split the SSPI based messaging code from the native messaging code
o cmake: fix NTLM detection when CURL_DISABLE_HTTP defined
o cmake: add Kerberos to the supported feature
o CURLOPT_POSTFIELDS.3: mention the COPYPOSTFIELDS option
o http: Disable pipelining for HTTP/2 and upgraded connections
o ntlm: Fixed static'ness of local decode function
o sasl: Reduced the need for two sets of NTLM messaging functions
o multi.c: Fixed compilation warnings when no verbose string support
o select.c: fix compilation for VxWorks [7]
o multi-single.c: switch to use curl_multi_wait
o curl_multi_wait.3: clarify numfds being used if not NULL
o http.c: Fixed compilation warnings from features being disabled
o NSS: enable the CAPATH option [9]
o docs: Fix FAILONERROR typos
o HTTP: don't abort connections with pending Negotiate authentication
o HTTP: Free (proxy)userpwd for NTLM/Negotiate after sending a request
o http_perhapsrewind: don't abort CONNECT requests
o build: updated dependencies in makefiles
o multi.c: Fixed compilation warning
o ftp.c: Fixed compilation warnings when proxy support disabled
o get_url_file_name: Fixed crash on OOM on debug build
o cookie.c: Refactored cleanup code to simplify
o OS400: enable NTLM authentication
o ntlm: Use Windows Crypt API
o http2: avoid logging neg "failure" if h2 was not requested
o schannel_recv: return the correct code [10]
o VC build: added sspi define for winssl-zlib builds
o Curl_client_write(): chop long data, convert data only once
o openldap: do not ignore Curl_client_write() return code
o ldap: check Curl_client_write() return codes
o parsedate.c: Fixed compilation warning
o url.c: Fixed compilation warning when USE_NTLM is not defined
o ntlm_wb_response: fix "statement not reached" [11]
o telnet: fix "cast increases required alignment of target type"
o smtp: Fixed dot stuffing when EOL characters at end of input buffers [12]
o ntlm: Allow NTLM2Session messages when USE_NTRESPONSES manually defined
o ntlm: Disable NTLM v2 when 64-bit integers are not supported
o ntlm: Use short integer when decoding 16-bit values
o ftp.c: Fixed compilation warning when no verbose string support
o synctime.c: fixed timeserver URLs
o mk-ca-bundle.pl: restored forced run again
o ntlm: Fixed return code for bad type-2 Target Info
o curl_schannel.c: Data may be available before connection shutdown
o curl_schannel: Improvements to memory re-allocation strategy [13]
o darwinssl: aprintf() to allocate the session key
o tool_util.c: Use GetTickCount64 if it is available
o lib: Fixed multiple code analysis warnings if SAL are available
o tool_binmode.c: Explicitly ignore the return code of setmode
o tool_urlglob.c: Silence warning C6293: Ill-defined for-loop
o opts: Warn CURLOPT_TIMEOUT overrides when set after CURLOPT_TIMEOUT_MS
o SFTP: work-around servers that return zero size on STAT [14]
o connect: singleipconnect(): properly try other address families after failure
o IPV6: address scope != scope id [15]
o parseurlandfillconn(): fix improper non-numeric scope_id stripping [16]
o secureserver.pl: make OpenSSL CApath and cert absolute path values
o secureserver.pl: update Windows detection and fix path conversion
o secureserver.pl: clean up formatting of config and fix verbose output
o tests: Added Windows support using Cygwin-based OpenSSH
o sockfilt.c: use non-Ex functions that are available before WinXP
o VMS: Updates for 0740-0D1220
o openssl: warn for SRP set if SSLv3 is used, not for TLS version
o openssl: make it compile against openssl 1.1.0-DEV master branch
o openssl: fix SSL/TLS versions in verbose output
o curl: show size of inhibited data when using -v
o build: Removed WIN32 definition from the Visual Studio projects
o build: Removed WIN64 definition from the libcurl Visual Studio projects
o vtls: Use bool for Curl_ssl_getsessionid() return type
o sockfilt.c: Replace 100ms sleep with thread throttle
o sockfilt.c: Reduce the number of individual memory allocations
o vtls: Don't set cert info count until memory allocation is successful
o nss: Don't ignore Curl_ssl_init_certinfo() OOM failure
o nss: Don't ignore Curl_extract_certinfo() OOM failure
o vtls: Fixed compilation warning and an ignored return code
o sockfilt.c: Fixed compilation warnings
o darwinssl: Fixed compilation warning
o vtls: Use '(void) arg' for unused parameters
o sepheaders.c: Fixed resource leak on failure
o lib1900.c: Fixed cppcheck error [17]
o ldap: Fixed Unicode connection details in Win32 initialsation / bind calls
o ldap: Fixed Unicode DN, attributes and filter in Win32 search calls
|
|
* SSLv3 is disabled by default
* CURLOPT_COOKIELIST: Added "RELOAD" command [5]
* build: Added WinIDN build configuration options to Visual Studio projects
* ssh: improve key file search
* SSL: public key pinning. Use CURLOPT_PINNEDPUBLICKEY and --pinnedpubkey
* vtls: remove QsoSSL support, use gskit!
* mk-ca-bundle: added SHA-384 signature algorithm
* docs: added many examples for libcurl opts and other doc improvements
* build: Added VC ssh2 target to main Makefile
* MinGW: Added support to build with nghttp2
* NetWare: Added support to build with nghttp2
* build: added Watcom support to build with WinSSL
* build: Added optional specific version generation of VC project files
Bugfixes:
* curl_easy_duphandle: CURLOPT_COPYPOSTFIELDS read out of bounds [9]
* openssl: build fix for versions < 0.9.8e [1]
* newlines: fix mixed newlines to LF-only [2]
* ntlm: Fixed HTTP proxy authentication when using Windows SSPI [3]
* sasl_sspi: Fixed Unicode build [4]
* file: reject paths using embedded %00
* threaded-resolver: revert Curl_expire_latest() switch [6]
* configure: allow --with-ca-path with PolarSSL too
* HTTP/2: Fix busy loop when EOF is encountered
* CURLOPT_CAPATH: return failure if set without backend support
* nss: do not fail if a CRL is already cached
* smtp: Fixed intermittent "SSL3_WRITE_PENDING: bad write retry" error
* fixed 20+ nits/memory leaks identified by Coverity scans
* curl_schannel.c: Fixed possible memory or handle leak
* multi-uv.c: call curl_multi_info_read() better
* Cmake: Check for OpenSSL before OpenLDAP
* Cmake: Fix library list provided to cURL tests
* Cmake: Avoid cycle directory dependencies
* Cmake: Build with GSS-API libraries (MIT or Heimdal)
* vtls: provide backend defines for internal source code
* nss: fix a connection failure when FTPS handle is reused
* tests/http_pipe.py: Python 3 support
* cmake: build tool_hugehelp (ENABLE_MANUAL)
* cmake: enable IPv6 by default if available
* tests: move TESTCASES to Makefile.inc, add show for cmake
* ntlm: Avoid unnecessary buffer allocation for SSPI based type-2 token
* ntlm: Fixed empty/bad base-64 decoded buffer return codes
* ntlm: Fixed empty type-2 decoded message info text
* cmake: add CMake/Macros.cmake to the release tarball
* cmake: add SUPPORT_FEATURES and SUPPORT_PROTOCOLS
* cmake: use LIBCURL_VERSION from curlver.h
* cmake: generate pkg-config and curl-config
* fixed several superfluous variable assignements identified by cppcheck
* cleanup of 'CURLcode result' return code
* pipelining: only output "is not blacklisted" in debug builds
* SSL: Remove SSLv3 from SSL default due to POODLE attack
* gskit.c: remove SSLv3 from SSL default
* darwinssl: detect possible future removal of SSLv3 from the framework
* ntlm: Only define ntlm data structure when USE_NTLM is defined
* ntlm: Return CURLcode from Curl_ntlm_core_mk_lm_hash()
* ntlm: Return all errors from Curl_ntlm_core_mk_nt_hash()
* sspi: Only call CompleteAuthToken() when complete is needed
* http_negotiate: Fixed missing check for USE_SPNEGO
* HTTP: return larger than 3 digit response codes too [7]
* openssl: Check for NPN / ALPN via OpenSSL version number
* openssl: enable NPN separately from ALPN
* sasl_sspi: Allow DIGEST-MD5 to use current windows credentials
* sspi: Return CURLE_LOGIN_DENIED on AcquireCredentialsHandle() failure
* resume: consider a resume from [content-length] to be OK [8]
* sasl: Fixed Kerberos V5 inclusion when CURL_DISABLE_CRYPTO_AUTH is used
* build-openssl.bat: Fix x64 release build
* cmake: drop _BSD_SOURCE macro usage
* cmake: fix gethostby{addr,name}_r in CurlTests
* cmake: clean OtherTests, fixing -Werror
* cmake: fix struct sockaddr_storage check
* Curl_single_getsock: fix hold/pause sock handling
* SSL: PolarSSL default min SSL version TLS 1.0
* cmake: fix ZLIB_INCLUDE_DIRS use [10]
* buildconf: stop checking for libtool
|
