diff options
| author | George Hazan <ghazan@miranda.im> | 2019-09-17 12:36:24 +0300 |
|---|---|---|
| committer | George Hazan <ghazan@miranda.im> | 2019-09-17 12:36:24 +0300 |
| commit | fe2500aa99137c9ce35907c118745d65a0c0c07e (patch) | |
| tree | 5b4024359b5344b1490f7568bfb6dec897cd1aae /libs/libcurl/docs | |
| parent | adbda1ab567b2baf45c80a62a6aa4c3171a5c2e3 (diff) | |
libcurl updated to 7.66
Diffstat (limited to 'libs/libcurl/docs')
| -rw-r--r-- | libs/libcurl/docs/CHANGES | 2978 | ||||
| -rw-r--r-- | libs/libcurl/docs/THANKS | 25 |
2 files changed, 1318 insertions, 1685 deletions
diff --git a/libs/libcurl/docs/CHANGES b/libs/libcurl/docs/CHANGES index 447b46a526..0047ab41ac 100644 --- a/libs/libcurl/docs/CHANGES +++ b/libs/libcurl/docs/CHANGES @@ -6,6 +6,1296 @@ Changelog +Version 7.66.0 (10 Sep 2019) + +Daniel Stenberg (10 Sep 2019) +- RELEASE-NOTES: curl 7.66.0 + +- THANKS: from the 7.66.0 release + +- curl: make sure the parallel transfers do them all + + The logic could erroneously break the loop too early before all + transfers had been transferred. + + Reported-by: Tom van der Woerdt + Fixes #4316 + Closes #4317 + +- urlapi: one colon is enough for the strspn() input (typo) + +- urlapi: verify the IPv6 numerical address + + It needs to parse correctly. Otherwise it could be tricked into letting + through a-f using host names that libcurl would then resolve. Like + '[ab.be]'. + + Reported-by: Thomas Vegas + Closes #4315 + +- [Clément Notin brought this change] + + openssl: use SSL_CTX_set_<min|max>_proto_version() when available + + OpenSSL 1.1.0 adds SSL_CTX_set_<min|max>_proto_version() that we now use + when available. Existing code is preserved for older versions of + OpenSSL. + + Closes #4304 + +- [Clément Notin brought this change] + + openssl: indent, re-organize and add comments + +- [migueljcrum brought this change] + + sspi: fix memory leaks + + Closes #4299 + +- travis: disable ngtcp2 builds (again) + +- Curl_fillreadbuffer: avoid double-free trailer buf on error + + Reviewed-by: Jay Satiro + Reported-by: Thomas Vegas + + Closes #4307 + +- tool_setopt: handle a libcurl build without netrc support + + Reported-by: codesniffer13 on github + Fixes #4302 + Closes #4305 + +- security:read_data fix bad realloc() + + ... that could end up a double-free + + CVE-2019-5481 + Bug: https://curl.haxx.se/docs/CVE-2019-5481.html + +- [Thomas Vegas brought this change] + + tftp: Alloc maximum blksize, and use default unless OACK is received + + Fixes potential buffer overflow from 'recvfrom()', should the server + return an OACK without blksize. + + Bug: https://curl.haxx.se/docs/CVE-2019-5482.html + CVE-2019-5482 + +- [Thomas Vegas brought this change] + + tftp: return error when packet is too small for options + +- KNOWN_BUGS/TODO: cleanup and remove outdated issues + +- RELEASE-NOTES: synced + +- netrc: free 'home' on error + + Follow-up to f9c7ba9096ec2 + + Coverity CID 1453474 + + Closes #4291 + +- urldata: avoid 'generic', use dedicated pointers + + For the 'proto' union within the connectdata struct. + + Closes #4290 + +- cleanup: move functions out of url.c and make them static + + Closes #4289 + +- smtp: check for and bail out on too short EHLO response + + Otherwise, a three byte response would make the smtp_state_ehlo_resp() + function misbehave. + + Credit to OSS-Fuzz + Bug: https://crbug.com/oss-fuzz/16918 + + Assisted-by: Max Dymond + + Closes #4287 + +- smb: init *msg to NULL in smb_send_and_recv() + + ... it might otherwise return OK from this function leaving that pointer + uninitialized. + + Bug: https://crbug.com/oss-fuzz/16907 + + Closes #4286 + +- ROADMAP: updated after recent user poll + + In rough prio order + +- THANKS: remove duplicate + +- Curl_addr2string: take an addrlen argument too + + This allows the function to figure out if a unix domain socket has a + file name or not associated with it! When a socket is created with + socketpair(), as done in the fuzzer testing, the path struct member is + uninitialized and must not be accessed. + + Bug: https://crbug.com/oss-fuzz/16699 + + Closes #4283 + +- [Rolf Eike Beer brought this change] + + CMake: remove needless newlines at end of gss variables + +- [Rolf Eike Beer brought this change] + + CI: remove duplicate configure flag for LGTM.com + +- [Rolf Eike Beer brought this change] + + CMake: use platform dependent name for dlopen() library + + Closes #4279 + +- quiche: expire when poll returned data + + ... to make sure we continue draining the queue until empty + + Closes #4281 + +- quiche: decrease available buffer size, don't assign it! + + Found-by: Jeremy Lainé + +- RELEASE-NOTES: synced + +- [Kyohei Kadota brought this change] + + curl: fix include conditions + +- [Kyohei Kadota brought this change] + + plan9: fix installation instructions + + Closes #4276 + +- ngtcp2: on h3 stream close, call expire + + ... to trigger a new read to detect the stream close! + + Closes #4275 + +- [Tatsuhiro Tsujikawa brought this change] + + ngtcp2: build latest ngtcp2 and ngtcp2_crypto_openssl + + Closes #4278 + +- ngtcp2: set flow control window to stream buffer size + + Closes #4274 + +- [Christopher Head brought this change] + + CURLOPT_HEADERFUNCTION.3: clarify + + Closes #4273 + +- CURLINFO docs: mention that in redirects times are added + + Suggested-by: Brandon Dong + Fixes #4250 + Closes #4269 + +- travis: enable ngtcp2 builds again + + Switched to the openssl-quic-draft-22 openssl branch. + + Closes #4271 + +- HTTP3: switched openssl branch to use + +- [Tatsuhiro Tsujikawa brought this change] + + ngtcp2: Build with latest ngtcp2 and ngtcp2_crypto_openssl + + Closes #4270 + +- http2: when marked for closure and wanted to close == OK + + It could otherwise return an error even when closed correctly if GOAWAY + had been received previously. + + Reported-by: Tom van der Woerdt + Fixes #4267 + Closes #4268 + +- RELEASE-NOTES: synced + +- build-openssl: fix build with Visual Studio 2019 + + Reviewed-by: Marcel Raad + Contributed-by: osabc on github + Fixes #4188 + Closes #4266 + +Kamil Dudka (26 Aug 2019) +- vauth: return CURLE_AUTH_ERROR on gss_init_sec_context() failure + + This is a follow-up to https://github.com/curl/curl/pull/3864 . + + Closes #4224 + +Daniel Stenberg (26 Aug 2019) +- KNOWN_BUGS: USE_UNIX_SOCKETS on Windows + + Closes #4040 + +- quiche: send the HTTP body correctly on callback uploads + + Closes #4265 + +- travis: disable ngtcp2 builds (temporarily) + + Just too many API changes right now + + Closes #4264 + +- ngtcp2: add support for SSLKEYLOGFILE + + Closes #4260 + +- ngtcp2: improve h3 response receiving + + Closes #4259 + +- ngtcp2: use nghttp3_version() + +- ngtcp2: sync with upstream API changes + + Assisted-by: Tatsuhiro Tsujikawa + +- [Kyle Abramowitz brought this change] + + scp: fix directory name length used in memcpy + + Fix read off end of array due to bad pointer math in getworkingpath for + SCP home directory case. + + Closes #4258 + +- http: the 'closed' struct field is used by both ngh2 and ngh3 + + and remove 'header_recvbuf', not used for anything + + Reported-by: Jeremy Lainé + + Closes #4257 + +- ngtcp2: accept upload via callback + + Closes #4256 + +- defines: avoid underscore-prefixed defines + + Double-underscored or underscore plus uppercase letter at least. + + ... as they're claimed to be reserved. + + Reported-by: patnyb on github + + Fixes #4254 + Closes #4255 + +- travis: add a build using ngtcp2 + nghttp3 (and a patched OpenSSL) + + Runs no tests + + Closes #4253 + +- travis: bump to using nghttp2 version 1.39.2 + + Closes #4252 + +- [Gisle Vanem brought this change] + + docs/examples/curlx: fix errors + + Initialise 'mimetype' and require the -p12 arg. + + Closes #4248 + +- cleanup: remove DOT_CHAR completely + + Follow-up to f9c7ba9096ec + + The use of DOT_CHAR for ".ssh" was probably a mistake and is removed + now. + + Pointed-out-by: Gisle Vanem + Bug: https://github.com/curl/curl/pull/4230#issuecomment-522960638 + + Closes #4247 + +- spnego_sspi: add typecast to fix build warning + + Reported in build "Win32 target on Debian Stretch (64-bit) - + i686-w64-mingw32 - gcc-20170516" + + Closes #4245 + +- openssl: build warning free with boringssl + + Closes #4244 + +- curl: make --libcurl use CURL_HTTP_VERSION_3 + + Closes #4243 + +- ngtcp2: make postfields-set posts work + + Closes #4242 + +- http: remove chunked-encoding and expect header use for HTTP/3 + +- [Alessandro Ghedini brought this change] + + configure: use pkg-config to detect quiche + + This removes the need to hard-code the quiche target path in + configure.ac. + + This depends on https://github.com/cloudflare/quiche/pull/128 + + Closes #4237 + +- CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2 + + For a long time (since 7.28.1) we've returned error when setting the + value to 1 to make applications notice that we stopped supported the old + behavior for 1. Starting now, we treat 1 and 2 exactly the same. + + Closes #4241 + +- curl: use .curlrc (with a dot) on Windows as well + + Fall-back to _curlrc if the dot-version is missing. + + Co-Authored-By: Steve Holme + + Closes #4230 + +- netrc: make the code try ".netrc" on Windows as well + + ... but fall back and try "_netrc" too if the dot version didn't work. + + Co-Authored-By: Steve Holme + +- ngtcp2: use ngtcp2_version() to get the run-time version + + ... which of course doesn't have to be the same used at build-time. + + Function just recently merged in ngtcp2. + +- ngtcp2: move the h3 initing to immediately after the rx key + + To fix a segfault and to better deal with 0-RTT + + Assisted-by: Tatsuhiro Tsujikawa + +- [Alessandro Ghedini brought this change] + + quiche: register debug callback once and earlier + + The quiche debug callback is global and can only be initialized once, so + make sure we don't do it multiple times (e.g. if multiple requests are + executed). + + In addition this initializes the callback before the connection is + created, so we get logs for the handshake as well. + + Closes #4236 + +- ssh: add a generic Curl_ssh_version function for SSH backends + + Closes #4235 + +- base64: check for SSH, not specific SSH backends + +- vssh: move ssh init/cleanup functions into backend code + +- vssh: create directory for SSH backend code + +- TODO/ROADMAP: remove "refuse downgrade redirects" and HTTP/3 + + HTTP3 is now already in full progress + + Downgrade redirects can be achived almost exactly like that by setting + CURLOPT_REDIR_PROTOCOLS. + +- RELEASE-NOTES: synced + +- travis: add a quiche build + + Closes #4207 + +- http: fix use of credentials from URL when using HTTP proxy + + When a username and password are provided in the URL, they were wrongly + removed from the stored URL so that subsequent uses of the same URL + wouldn't find the crendentials. This made doing HTTP auth with multiple + connections (like Digest) mishave. + + Regression from 46e164069d1a5230 (7.62.0) + + Test case 335 added to verify. + + Reported-by: Mike Crowe + + Fixes #4228 + Closes #4229 + +- [Mike Crowe brought this change] + + tests: Replace outdated test case numbering documentation + + Tests are no longer grouped by numeric range[1]. Let's stop saying that + and provide some alternative advice for numbering tests. + + [1] https://curl.haxx.se/mail/lib-2019-08/0043.html + + Closes #4227 + +- travis: reduce number of torture tests in 'coverage' + + ... to make it complete in time. This cut seems not almost not affect + the coverage percentage and yet completes within 35 minutes on travis + where the previous runs recently always timed out after 50. + + Closes #4223 + +- [Igor Makarov brought this change] + + configure: use -lquiche to link to quiche + + Closes #4226 + +- ngtcp2: provide the callbacks as a static struct + + ... instead of having them in quicsocket + +- [Tatsuhiro Tsujikawa brought this change] + + ngtcp2: add missing nghttp3_conn_add_write_offset call + + Closes #4225 + +- [Tatsuhiro Tsujikawa brought this change] + + ngtcp2: deal with stream close + +- [Tatsuhiro Tsujikawa brought this change] + + ngtcp2: Consume QUIC STREAM data properly + +- [Tatsuhiro Tsujikawa brought this change] + + ngtcp2: don't reinitialize SSL on Retry + +- multi: getsock improvements for QUIC connecting + +- connect: connections are persistent by default for HTTP/3 + +- quiche: happy eyeballs + + Closes #4220 + +- ngtcp2: do QUIC connections happy-eyeballs friendly + +- curl_version: bump string buffer size to 250 + + With HTTP/3 libs and plenty TLS libs, I manged to hit the limit (which + causes a truncated output). + +- CURLOPT_ALTSVC.3: use a "" file name to not load from a file + +Jay Satiro (14 Aug 2019) +- vauth: Use CURLE_AUTH_ERROR for auth function errors + + - Add new error code CURLE_AUTH_ERROR. + + Prior to this change auth function errors were signaled by + CURLE_OUT_OF_MEMORY and CURLE_RECV_ERROR, and neither one was + technically correct. + + Ref: https://github.com/curl/curl/pull/3848 + + Co-authored-by: Dominik Hölzl + + Closes https://github.com/curl/curl/pull/3864 + +Daniel Stenberg (13 Aug 2019) +- curl_version_info: make the quic_version a const + + Follow-up from 1a2df1518ad8653f + + Closes #4222 + +- examples: add http3.c, altsvc.c and http3-present.c + + Closes #4221 + +Peter Wu (13 Aug 2019) +- nss: use TLSv1.3 as default if supported + + SSL_VersionRangeGetDefault returns (TLSv1.0, TLSv1.2) as supported + range in NSS 3.45. It looks like the intention is to raise the minimum + version rather than lowering the maximum, so adjust accordingly. Note + that the caller (nss_setup_connect) initializes the version range to + (TLSv1.0, TLSv1.3), so there is no need to check for >= TLSv1.0 again. + + Closes #4187 + Reviewed-by: Daniel Stenberg + Reviewed-by: Kamil Dudka + +Daniel Stenberg (13 Aug 2019) +- quic.h: remove unused proto + +- curl_version_info.3: mentioned ALTSVC and HTTP3 + + ... and sorted the list alphabetically + +- lib/quic.c: unused - removed + +- CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED + + Follow-up to 98c3f148 that removed it from the header file + +- [Junho Choi brought this change] + + docs/HTTP3: simplify quiche build instruction + + Use --recursive to get boringssl in one line + + Closes #4219 + +- altsvc: make it use h3-22 with ngtcp2 as well + +- ngtcp2: initial h3 request work + + Closes #4217 + +- curl_version_info: offer quic (and h3) library info + + Closes #4216 + +- HTTP3: use ngtcp2's draft-22 branch + +- RELEASE-NOTES: synced + +- CURLOPT_READFUNCTION.3: provide inline example + + ... instead of mentioning one in another place + +- [Tatsuhiro Tsujikawa brought this change] + + ngtcp2: send HTTP/3 request with nghttp3 + + This commit makes sending HTTP/3 request with nghttp3 work. It + minimally receives HTTP response and calls nghttp3 callbacks, but no + processing is made at the moment. + + Closes #4215 + +- nghttp3: initial h3 template code added + +- nghttp3: required when ngtcp2 is used for QUIC + + - checked for by configure + - updated docs/HTTP3.md + - shown in the version string + + Closes #4210 + +- [Eric Wong brought this change] + + asyn-thread: issue CURL_POLL_REMOVE before closing socket + + This avoids EBADF errors from EPOLL_CTL_DEL operations in the + ephiperfifo.c example. EBADF is dangerous in multi-threaded + applications where I rely on epoll_ctl to operate on the same + epoll description from different threads. + + Follow-up to eb9a604f8d7db8 + + Bug: https://curl.haxx.se/mail/lib-2019-08/0026.html + Closes #4211 + +- [Carlo Marcelo Arenas Belón brought this change] + + configure: avoid undefined check_for_ca_bundle + + instead of using a "greater than 0" test, check for variable being + set, as it is always set to 1, and could be left unset if non of + OPENSSL MBEDTLS GNUTLS WOLFSSL is being configured for. + + Closes #4213 + +- [Tatsuhiro Tsujikawa brought this change] + + ngtcp2: Send ALPN h3-22 + + Closes #4212 + +- [Tatsuhiro Tsujikawa brought this change] + + ngtcp2: use ngtcp2_settings_default and specify initial_ts + +- curl_global_init_mem.3: mention it was added in 7.12.0 + +- [Tatsuhiro Tsujikawa brought this change] + + ngtcp2: make the QUIC handshake work + + Closes #4209 + +- [Alex Mayorga brought this change] + + HTTP3.md: Update quiche build instructions + + Added cloning for quiche and BoringSSL and modified the build + instructions so they work on a clean folder. + + Closes #4208 + +- CURLOPT_H3: removed + + There's no use for this anymore and it was never in a release. + + Closes #4206 + +- http3: make connection reuse work + + Closes #4204 + +- quiche: add SSLKEYLOGFILE support + +- cleanup: s/curl_debug/curl_dbg_debug in comments and docs + + Leftovers from the function rename back in 76b63489495 + + Reported-by: Gisle Vanem + Bug: https://github.com/curl/curl/commit/f3e0f071b14fcb46a453f69bdf4e062bcaacf362#com + mitcomment-34601751 + + Closes #4203 + +- RELEASE-NOTES: synced + +- alt-svc: add protocol version selection masking + + So that users can mask in/out specific HTTP versions when Alt-Svc is + used. + + - Removed "h2c" and updated test case accordingly + - Changed how the altsvc struct is laid out + - Added ifdefs to make the unittest run even in a quiche-tree + + Closes #4201 + +- http3: fix the HTTP/3 in the request, make alt-svc set right versions + + Closes #4200 + +- alt-svc: send Alt-Used: in redirected requests + + RFC 7838 section 5: + + When using an alternative service, clients SHOULD include an Alt-Used + header field in all requests. + + Removed CURLALTSVC_ALTUSED again (feature is still EXPERIMENTAL thus + this is deemed ok). + + You can disable sending this header just like you disable any other HTTP + header in libcurl. + + Closes #4199 + +- CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly + + Even though it cannot fall-back to a lower HTTP version automatically. The + safer way to upgrade remains via CURLOPT_ALTSVC. + + CURLOPT_H3 no longer has any bits that do anything and might be removed + before we remove the experimental label. + + Updated the curl tool accordingly to use "--http3". + + Closes #4197 + +- docs/ALTSVC: remove what works and the experimental explanation + + Also, put the TODO items at the bottom. + + Closes #4198 + +- docs/EXPERIMENTAL: explain what it means and what's experimental now + +- curl: make use of CURLINFO_RETRY_AFTER when retrying + + If a Retry-After: header was used in the response, that value overrides + other retry timing options. + + Fixes #3794 + Closes #4195 + +- curl: use CURLINFO_PROTOCOL to check for HTTP(s) + + ... instead of CURLINFO_EFFECTIVE_URL to avoid string operations. + +- CURLINFO_RETRY_AFTER: parse the Retry-After header value + + This is only the libcurl part that provides the information. There's no + user of the parsed value. This change includes three new tests for the + parser. + + Ref: #3794 + +- docs/ALTSVC.md: first basic file format description + +- curl: have -w's 'http_version' show '3' for HTTP/3 + + Closes #4196 + +- curl.h: add CURL_HTTP_VERSION_3 to the version enum + + It can't be set for CURLOPT_HTTP_VERSION, but it can be extracted with + CURLINFO_HTTP_VERSION. + +- quiche: make use of the connection timeout API properly + +- quiche: make POSTFIELDS posts work + +- quiche: improved error handling and memory cleanups + +- quiche: flush egress in h3_stream_recv() too + +- RELEASE-NOTES: synced + +Jay Satiro (6 Aug 2019) +- [Patrick Monnerat brought this change] + + os400: take care of CURLOPT_SASL_AUTHZID in curl_easy_setopt_ccsid(). + + Ref: https://github.com/curl/curl/issues/3653 + Ref: https://github.com/curl/curl/pull/3790 + + NOTE: This commit was cherry-picked and is part of a series of commits + that added the authzid feature for upcoming 7.66.0. The series was + temporarily reverted in db8ec1f so that it would not ship in a 7.65.x + patch release. + + Closes https://github.com/curl/curl/pull/4186 + +- tests: Fix the line endings for the SASL alt-auth tests + + - Change data and protocol sections to CRLF line endings. + + Prior to this change the tests would fail or hang, which is because + certain sections such as protocol require CRLF line endings. + + Follow-up to grandparent commit which added the tests. + + Ref: https://github.com/curl/curl/issues/3653 + Ref: https://github.com/curl/curl/pull/3790 + + NOTE: This commit was cherry-picked and is part of a series of commits + that added the authzid feature for upcoming 7.66.0. The series was + temporarily reverted in db8ec1f so that it would not ship in a 7.65.x + patch release. + + Closes https://github.com/curl/curl/pull/4186 + +- [Steve Holme brought this change] + + examples: Added SASL PLAIN authorisation identity (authzid) examples + + Ref: https://github.com/curl/curl/issues/3653 + Ref: https://github.com/curl/curl/pull/3790 + + NOTE: This commit was cherry-picked and is part of a series of commits + that added the authzid feature for upcoming 7.66.0. The series was + temporarily reverted in db8ec1f so that it would not ship in a 7.65.x + patch release. + + Closes https://github.com/curl/curl/pull/4186 + +- [Steve Holme brought this change] + + curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool + + Ref: https://github.com/curl/curl/issues/3653 + Ref: https://github.com/curl/curl/pull/3790 + + NOTE: This commit was cherry-picked and is part of a series of commits + that added the authzid feature for upcoming 7.66.0. The series was + temporarily reverted in db8ec1f so that it would not ship in a 7.65.x + patch release. + + Closes https://github.com/curl/curl/pull/4186 + +- [Steve Holme brought this change] + + sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID + + Added the ability for the calling program to specify the authorisation + identity (authzid), the identity to act as, in addition to the + authentication identity (authcid) and password when using SASL PLAIN + authentication. + + Fixes #3653 + Closes #3790 + + NOTE: This commit was cherry-picked and is part of a series of commits + that added the authzid feature for upcoming 7.66.0. The series was + temporarily reverted in db8ec1f so that it would not ship in a 7.65.x + patch release. + + Closes https://github.com/curl/curl/pull/4186 + +Daniel Stenberg (6 Aug 2019) +- docs/HTTP3: refreshed as it is now in master and HTTP/3 can be tested + +- [Yiming Jing brought this change] + + mesalink: implement client authentication + + Closes #4184 + +- curl_multi_poll: a sister to curl_multi_wait() that waits more + + Repeatedly we see problems where using curl_multi_wait() is difficult or + just awkward because if it has no file descriptor to wait for + internally, it returns immediately and leaves it to the caller to wait + for a small amount of time in order to avoid occasional busy-looping. + + This is often missed or misunderstood, leading to underperforming + applications. + + This change introduces curl_multi_poll() as a replacement drop-in + function that accepts the exact same set of arguments. This function + works identically to curl_multi_wait() - EXCEPT - for the case when + there's nothing to wait for internally, as then this function will by + itself wait for a "suitable" short time before it returns. This + effectiely avoids all risks of busy-looping and should also make it less + likely that apps "over-wait". + + This also changes the curl tool to use this funtion internally when + doing parallel transfers and changes curl_easy_perform() to use it + internally. + + Closes #4163 + +- quiche:h3_stream_recv return 0 at end of stream + + ... and remove some verbose messages we don't need. Made transfers from + facebook.com work better. + +- altsvc: make quiche use h3-22 now + +- quiche: show the actual version number + +- quiche: first working HTTP/3 request + + - enable debug log + - fix use of quiche API + - use download buffer + - separate header/body + + Closes #4193 + +- http09: disable HTTP/0.9 by default in both tool and library + + As the plan has been laid out in DEPRECATED. Update docs accordingly and + verify in test 1174. Now requires the option to be set to allow HTTP/0.9 + responses. + + Closes #4191 + +- quiche: initial h3 request send/receive + +- lib/Makefile.am: make checksrc run in vquic too + +- altsvc: fix removal of expired cache entry + + Closes #4192 + +- RELEASE-NOTES: synced + +Steve Holme (4 Aug 2019) +- md4: Use our own MD4 implementation when no crypto libraries are available + + Closes #3780 + +- md4: No need to include Curl_md4.h for each TLS library + +- md4: No need for the NTLM code to call Curl_md4it() for each TLS library + + As the NTLM code no longer calls any of TLS libraries' specific MD4 + functions, there is no need to call this function for each #ifdef. + +- md4: Move the mbed TLS MD4 implementation out of the NTLM code + +- md4: Move the WinCrypt implementation out of the NTLM code + +- md4: Move the SecureTransport implementation out of the NTLM code + +- md4: Use the Curl_md4it() function for OpenSSL based NTLM + +- md4: Move the GNU TLS gcrypt MD4 implementation out of the NTLM code + +- md4: Move the GNU TLS Nettle MD4 implementation out of the NTLM code + +Jay Satiro (4 Aug 2019) +- OS400: Add CURLOPT_H3 symbols + + Follow-up to 3af0e76 which added experimental H3 support. + + Closes https://github.com/curl/curl/pull/4185 + +Daniel Stenberg (3 Aug 2019) +- url: make use of new HTTP version if alt-svc has one + +- url: set conn->transport to default TCP at init time + +- altsvc: with quiche, use the quiche h3 alpn string + + Closes #4183 + +- alt-svc: more liberal ALPN name parsing + + Allow pretty much anything to be part of the ALPN identifier. In + particular minus, which is used for "h3-20" (in-progress HTTP/3 + versions) etc. + + Updated test 356. + Closes #4182 + +- quiche: use the proper HTTP/3 ALPN + +- quiche: add failf() calls for two error cases + + To aid debugging + + Closes #4181 + +- mailmap: added Kyohei Kadota + +Kamil Dudka (1 Aug 2019) +- http_negotiate: improve handling of gss_init_sec_context() failures + + If HTTPAUTH_GSSNEGOTIATE was used for a POST request and + gss_init_sec_context() failed, the POST request was sent + with empty body. This commit also restores the original + behavior of `curl --fail --negotiate`, which was changed + by commit 6c6035532383e300c712e4c1cd9fdd749ed5cf59. + + Add regression tests 2077 and 2078 to cover this. + + Fixes #3992 + Closes #4171 + +Daniel Stenberg (1 Aug 2019) +- mailmap: added 4 more names + + Evgeny Grin, Peter Pih, Anton Malov and Marquis de Muesli + +- mailmap: add Giorgos Oikonomou + +- src/makefile: fix uncompressed hugehelp.c generation + + Regression from 5cf5d57ab9 (7.64.1) + + Fixed-by: Lance Ware + Fixes #4176 + Closes #4177 + +- appveyor: pass on -k to make + +- timediff: make it 64 bit (if possible) even with 32 bit time_t + + ... to make it hold microseconds too. + + Fixes #4165 + Closes #4168 + +- ROADMAP: parallel transfers are merged now + +- getenv: support up to 4K environment variable contents on windows + + Reported-by: Michal Čaplygin + Fixes #4174 + Closes #4175 + +- [Kyohei Kadota brought this change] + + plan9: add support for running on Plan 9 + + Closes #3701 + +- [Kyohei Kadota brought this change] + + ntlm: explicit type casting + +- [Justin brought this change] + + curl.h: fix outdated comment + + Closes #4167 + +- curl: remove outdated comment + + Turned bad with commit b8894085000 + + Reported-by: niallor on github + Fixes #4172 + Closes #4173 + +- cleanup: remove the 'numsocks' argument used in many places + + It was used (intended) to pass in the size of the 'socks' array that is + also passed to these functions, but was rarely actually checked/used and + the array is defined to a fixed size of MAX_SOCKSPEREASYHANDLE entries + that should be used instead. + + Closes #4169 + +- readwrite_data: repair setting the TIMER_STARTTRANSFER stamp + + Regression, broken in commit 65eb65fde64bd5f (curl 7.64.1) + + Reported-by: Jonathan Cardoso Machado + Assisted-by: Jay Satiro + + Fixes #4136 + Closes #4162 + +- mailmap: Amit Katyal + +- asyn-thread: removed unused variable + + Follow-up to eb9a604f. Mistake caused by me when I edited the commit + before push... + +- RELEASE-NOTES: synced + +- [Amit Katyal brought this change] + + asyn-thread: create a socketpair to wait on + + Closes #4157 + +- curl: cap the maximum allowed values for retry time arguments + + ... to avoid integer overflows later when multiplying with 1000 to + convert seconds to milliseconds. + + Added test 1269 to verify. + + Reported-by: Jason Lee + Closes #4166 + +- progress: reset download/uploaded counter + + ... to make CURLOPT_MAX_RECV_SPEED_LARGE and + CURLOPT_MAX_SEND_SPEED_LARGE work correctly on subsequent transfers that + reuse the same handle. + + Fixed-by: Ironbars13 on github + Fixes #4084 + Closes #4161 + +- http2_recv: trigger another read when the last data is returned + + ... so that end-of-stream is detected properly. + + Reported-by: Tom van der Woerdt + Fixes #4043 + Closes #4160 + +- curl: avoid uncessary libcurl timeouts (in parallel mode) + + When curl_multi_wait() returns OK without file descriptors to wait for, + it might already have done a long timeout. + + Closes #4159 + +- [Balazs Kovacsics brought this change] + + HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown + + If using the read callback for HTTP_POST, and POSTFIELDSIZE is not set, + automatically add a Transfer-Encoding: chunked header, same as it is + already done for HTTP_PUT, HTTP_POST_FORM and HTTP_POST_MIME. Update + test 1514 according to the new behaviour. + + Closes #4138 + +Jay Satiro (29 Jul 2019) +- [Daniel Stenberg brought this change] + + winbuild: add vquic to list of build directories + + This fixes the winbuild build method which broke several days ago + when experimental quic support was added in 3af0e76. + + Reported-by: Michael Lee + + Fixes https://github.com/curl/curl/issues/4158 + +- easy: resize receive buffer on easy handle reset + + - In curl_easy_reset attempt to resize the receive buffer to its default + size. If realloc fails then continue using the previous size. + + Prior to this change curl_easy_reset did not properly handle resetting + the receive buffer (data->state.buffer). It reset the variable holding + its size (data->set.buffer_size) to the default size (READBUFFER_SIZE) + but then did not actually resize the buffer. If a user resized the + buffer by using CURLOPT_BUFFERSIZE to set the size smaller than the + default, later called curl_easy_reset and attempted to reuse the handle + then a heap overflow would very likely occur during that handle's next + transfer. + + Reported-by: Felix Hädicke + + Fixes https://github.com/curl/curl/issues/4143 + Closes https://github.com/curl/curl/pull/4145 + +- [Brad Spencer brought this change] + + examples: Avoid reserved names in hiperfifo examples + + - Trade in __attribute__((unused)) for the classic (void)x to silence + unused symbols. + + Because the classic way is not gcc specific. Also because the prior + method mapped to symbol _Unused, which starts with _ and a capital + letter which is reserved. + + Assisted-by: The Infinnovation team + + Bug: https://github.com/curl/curl/issues/4120#issuecomment-512542108 + + Closes https://github.com/curl/curl/pull/4153 + +Daniel Stenberg (25 Jul 2019) +- RELEASE-NOTES: synced + +- [Felix Hädicke brought this change] + + ssh-libssh: do not specify O_APPEND when not in append mode + + Specifying O_APPEND in conjunction with O_TRUNC and O_CREAT does not + make much sense. And this combination of flags is not accepted by all + SFTP servers (at least not Apache SSHD). + + Fixes #4147 + Closes #4148 + +- [Gergely Nagy brought this change] + + multi: call detach_connection before Curl_disconnect + + Curl_disconnect bails out if conn->easyq is not empty, detach_connection + needs to be called first to remove the current easy from the queue. + + Fixes #4144 + Closes #4151 + +Jay Satiro (23 Jul 2019) +- tool_operate: fix implicit call to easysrc_cleanup + + easysrc_cleanup is only defined when CURL_DISABLE_LIBCURL_OPTION is not + defined, and prior to this change would be called regardless. + + Bug: https://github.com/curl/curl/pull/3804#issuecomment-513922637 + Reported-by: Marcel Raad + + Closes https://github.com/curl/curl/pull/4142 + +Daniel Stenberg (22 Jul 2019) +- curl:create_transfers check return code from curl_easy_setopt + + From commit b8894085 + + Pointed out by Coverity CID 1451703 + + Closes #4134 + +- HTTP3: initial (experimental) support + + USe configure --with-ngtcp2 or --with-quiche + + Using either option will enable a HTTP3 build. + Co-authored-by: Alessandro Ghedini <alessandro@ghedini.me> + + Closes #3500 + +- curl: remove dead code + + The loop never loops (since b889408500), pointed out by Coverity (CID + 1451702) + + Closes #4133 + +- docs/PARALLEL-TRANSFERS: correct the version number + +- docs/PARALLEL-TRANSFERS: added + +- curl: support parallel transfers + + This is done by making sure each individual transfer is first added to a + linked list as then they can be performed serially, or at will, in + parallel. + + Closes #3804 + +- docs/MANUAL.md: converted to markdown from plain text + + ... will make it render as a nicer web page. + + Closes #4131 + +- curl_version_info: provide nghttp2 details + + Introducing CURLVERSION_SIXTH with nghttp2 info. + + Closes #4121 + +- bump: start working on 7.66.0 + +- source: remove names from source comments + + Several reasons: + + - we can't add everyone who's helping out so its unfair to just a few + selected ones. + - we already list all helpers in THANKS and in RELEASE-NOTES for each + release + - we don't want to give the impression that some parts of the code is + "owned" or "controlled" by specific persons + + Assisted-by: Daniel Gustafsson + Closes #4129 + Version 7.65.3 (19 Jul 2019) Daniel Stenberg (19 Jul 2019) @@ -59,7 +1349,7 @@ Jay Satiro (17 Jul 2019) Closes https://github.com/curl/curl/pull/4118 -- [georgeok brought this change] +- [Giorgos Oikonomou brought this change] CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH @@ -3621,7 +4911,7 @@ Jay Satiro (25 Feb 2019) Fixes https://github.com/curl/curl/issues/3595 Closes https://github.com/curl/curl/pull/3596 -- [georgeok brought this change] +- [Giorgos Oikonomou brought this change] schannel: support CALG_ECDH_EPHEM algorithm @@ -4651,7 +5941,7 @@ Daniel Stenberg (4 Feb 2019) CVE-2018-16890 Marcel Raad (1 Feb 2019) -- [georgeok brought this change] +- [Giorgos Oikonomou brought this change] spnego_sspi: add support for channel binding @@ -4824,7 +6114,7 @@ Daniel Stenberg (19 Jan 2019) Closes #3484 Marcel Raad (19 Jan 2019) -- [georgeok brought this change] +- [Giorgos Oikonomou brought this change] ntlm_sspi: add support for channel binding @@ -6333,1683 +7623,3 @@ Daniel Stenberg (12 Nov 2018) practice". Closes #3225 - -- curl: --local-port range was not "including" - - The end port number in a given range was not included in the range used, - as it is documented to be. - - Reported-by: infinnovation-dev on github - Fixes #3251 - Closes #3255 - -- [Jérémy Rocher brought this change] - - openssl: support BoringSSL TLS renegotiation - - As per BoringSSL porting documentation [1], BoringSSL rejects peer - renegotiations by default. - - curl fails when trying to authenticate to server through client - certificate if it is requested by server after the initial TLS - handshake. - - Enable renegotiation by default with BoringSSL to get same behavior as - with OpenSSL. This is done by calling SSL_set_renegotiate_mode [2] - which was introduced in commit 1d5ef3bb1eb9 [3]. - - 1 - https://boringssl.googlesource.com/boringssl/+/HEAD/PORTING.md#tls-renegotiation - 2 - https://boringssl.googlesource.com/boringssl/+/master/include/openssl/ssl.h#3482 - 3 - https://boringssl.googlesource.com/boringssl/+/1d5ef3bb1eb97848617db5e7d633d735a401df86 - - Signed-off-by: Jérémy Rocher <rocher.jeremy@gmail.com> - Fixes #3258 - Closes #3259 - -- HISTORY: add some milestones - - Added a few of the more notable milestones in curl history that were - missing. Primarily more recent ones but I also noted some older that - could be worth mentioning. - - [ci skip] - Closes #3257 - -Daniel Gustafsson (9 Nov 2018) -- KNOWN_BUGS: add --proxy-any connection issue - - Add the identified issue with --proxy-any and proxy servers which - advertise authentication schemes other than the supported one. - - Closes #876 - Closes #3250 - Reported-by: NTMan on Github - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -Daniel Stenberg (9 Nov 2018) -- [Jim Fuller brought this change] - - setopt: add CURLOPT_CURLU - - Allows an application to pass in a pre-parsed URL via a URL handle. - - Closes #3227 - -- [Gisle Vanem brought this change] - - docs: ESCape "\n" codes - - Groff / Troff will display a: - printaf("Errno: %ld\n", error); - as: - printf("Errno: %ld0, error); - - when a "\n" is not escaped. Use "\\n" instead. - - Closes #3246 - -- curl: --local-port fix followup - - Regression by 52db54869e6. - - Reported-by: infinnovation-dev on github - Fixes #3248 - Closes #3249 - -GitHub (7 Nov 2018) -- [Gisle Vanem brought this change] - - More "\n" ESCaping - -Daniel Stenberg (7 Nov 2018) -- RELEASE-NOTES: synced - -- curl: fix --local-port integer overflow - - The tool's local port command line range parser didn't check for integer - overflows and could pass "weird" data to libcurl for this option. - libcurl however, has a strict range check for the values so it rejects - anything outside of the accepted range. - - Reported-by: Brian Carpenter - Closes #3242 - -- curl: correct the switch() logic in ourWriteOut - - Follow-up to e431daf013, as I did the wrong correction for a compiler - warning. It should be a break and not a fall-through. - - Pointed-out-by: Frank Gevaerts - -- [Frank Gevaerts brought this change] - - curl: add %{stderr} and %{stdout} for --write-out - - Closes #3115 - -Daniel Gustafsson (7 Nov 2018) -- winssl: be consistent in Schannel capitalization - - The productname from Microsoft is "Schannel", but in infof/failf - reporting we use "schannel". This removes different versions. - - Closes #3243 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -Daniel Stenberg (7 Nov 2018) -- TODO: Have the URL API offer IDN decoding - - Similar to how URL decoding/encoding is done, we could have URL - functions to convert IDN host names to punycode. - - Suggested-by: Alexey Melnichuk - Closes #3232 - -- urlapi: only skip encoding the first '=' with APPENDQUERY set - - APPENDQUERY + URLENCODE would skip all equals signs but now it only skip - encoding the first to better allow "name=content" for any content. - - Reported-by: Alexey Melnichuk - Fixes #3231 - Closes #3231 - -- url: a short host name + port is not a scheme - - The function identifying a leading "scheme" part of the URL considered a - few letters ending with a colon to be a scheme, making something like - "short:80" to become an unknown scheme instead of a short host name and - a port number. - - Extended test 1560 to verify. - - Also fixed test203 to use file_pwd to make it get the correct path on - windows. Removed test 2070 since it was a duplicate of 203. - - Assisted-by: Marcel Raad - Reported-by: Hagai Auro - Fixes #3220 - Fixes #3233 - Closes #3223 - Closes #3235 - -- [Sangamkar brought this change] - - libcurl: stop reading from paused transfers - - In the transfer loop it would previously not acknwledge the pause bit - and continue until drained or loop ended. - - Closes #3240 - -Jay Satiro (6 Nov 2018) -- tool: add undocumented option --dump-module-paths for win32 - - - Add an undocumented diagnostic option for Windows to show the full - paths of all loaded modules regardless of whether or not libcurl - initialization succeeds. - - This is needed so that in the CI we can get a list of all DLL - dependencies after initialization (when they're most likely to have - finished loading) and then package them as artifacts so that a - functioning build can be downloaded. Also I imagine it may have some use - as a diagnostic for help requests. - - Ref: https://github.com/curl/curl/pull/3103 - - Closes https://github.com/curl/curl/pull/3208 - -- curl_multibyte: fix a malloc overcalculation - - Prior to this change twice as many bytes as necessary were malloc'd when - converting wchar to UTF8. To allay confusion in the future I also - changed the variable name for the amount of bytes from len to bytes. - - Closes https://github.com/curl/curl/pull/3209 - -Michael Kaufmann (5 Nov 2018) -- netrc: don't ignore the login name specified with "--user" - - - for "--netrc", don't ignore the login/password specified with "--user", - only ignore the login/password in the URL. - This restores the netrc behaviour of curl 7.61.1 and earlier. - - fix the documentation of CURL_NETRC_REQUIRED - - improve the detection of login/password changes when reading .netrc - - don't read .netrc if both login and password are already set - - Fixes #3213 - Closes #3224 - -Patrick Monnerat (5 Nov 2018) -- OS400: add URL API ccsid wrappers and sync ILE/RPG bindings - -Daniel Stenberg (5 Nov 2018) -- [Yasuhiro Matsumoto brought this change] - - curl: fixed UTF-8 in current console code page (Windows) - - Fixes #3211 - Fixes #3175 - Closes #3212 - -- TODO: 2.6 multi upkeep - - Closes #3199 - -Daniel Gustafsson (5 Nov 2018) -- unittest: make 1652 stable across collations - - The previous coding used a format string whose output depended on the - current locale of the environment running the test. Since the gist of - the test is to have a format string, with the actual formatting being - less important, switch to a more stable formatstring with decimals. - - Reported-by: Marcel Raad - Closes #3234 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com> - -Daniel Stenberg (5 Nov 2018) -- Revert "url: a short host name + port is not a scheme" - - This reverts commit 226cfa8264cd979eff3fd52c0f3585ef095e7cf2. - - This commit caused test failures on appveyor/windows. Work on fixing them is - in #3235. - -- symbols-in-versions: add missing CURLU_ symbols - - ...and fix symbol-scan.pl to also scan urlapi.h - - Reported-by: Alexey Melnichuk - Fixes #3226 - Closes #3230 - -Daniel Gustafsson (3 Nov 2018) -- infof: clearly indicate truncation - - The internal buffer in infof() is limited to 2048 bytes of payload plus - an additional byte for NULL termination. Servers with very long error - messages can however cause truncation of the string, which currently - isn't very clear, and leads to badly formatted output. - - This appends a "...\n" (or just "..." in case the format didn't with a - newline char) marker to the end of the string to clearly show - that it has been truncated. - - Also include a unittest covering infof() to try and catch any bugs - introduced in this quite important function. - - Closes #3216 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com> - -Michael Kaufmann (3 Nov 2018) -- tool_getparam: fix some comments - -Daniel Stenberg (3 Nov 2018) -- url: a short host name + port is not a scheme - - The function identifying a leading "scheme" part of the URL considered a few - letters ending with a colon to be a scheme, making something like "short:80" - to become an unknown scheme instead of a short host name and a port number. - - Extended test 1560 to verify. - - Reported-by: Hagai Auro - Fixes #3220 - Closes #3223 - -- URL: fix IPv6 numeral address parser - - Regression from 46e164069d1a52. Extended test 1560 to verify. - - Reported-by: tpaukrt on github - Fixes #3218 - Closes #3219 - -- travis: remove curl before a normal build - - on Linux. To make sure the test suite runs with its newly build tool and - doesn't require an external one present. - - Bug: #3198 - Closes #3200 - -- [Tim Rühsen brought this change] - - mprintf: avoid unsigned integer overflow warning - - The overflow has no real world impact. - Just avoid it for "best practice". - - Code change suggested by "The Infinnovation Team" and Daniel Stenberg. - Closes #3184 - -- Curl_follow: accept non-supported schemes for "fake" redirects - - When not actually following the redirect and the target URL is only - stored for later retrieval, curl always accepted "non-supported" - schemes. This was a regression from 46e164069d1a5230. - - Reported-by: Brad King - Fixes #3210 - Closes #3215 - -Daniel Gustafsson (2 Nov 2018) -- openvms: fix example name - - Commit efc696a2e09225bfeab4 renamed persistant.c to persistent.c to - fix the typo in the name, but missed to update the OpenVMS package - files which still looked for the old name. - - Closes #3217 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - Reviewed-by: Viktor Szakats <commit@vszakats.net> - -Daniel Stenberg (1 Nov 2018) -- configure: show CFLAGS, LDFLAGS etc in summary - - To make it easier to understand other people's and remote builds etc. - - Closes #3207 - -- version: bump for next cycle - -- axtls: removed - - As has been outlined in the DEPRECATE.md document, the axTLS code has - been disabled for 6 months and is hereby removed. - - Use a better supported TLS library! - - Assisted-by: Daniel Gustafsson - Closes #3194 - -- [marcosdiazr brought this change] - - schannel: make CURLOPT_CERTINFO support using Issuer chain - - Closes #3197 - -- travis: build with sanitize=address,undefined,signed-integer-overflow - - ... using clang - - Closes #3190 - -- schannel: use Curl_ prefix for global private symbols - - Curl_verify_certificate() must use the Curl_ prefix since it is globally - available in the lib and otherwise steps outside of our namespace! - - Closes #3201 - -Kamil Dudka (1 Nov 2018) -- tests: drop http_pipe.py script no longer used - - It is unused since commit f7208df7d9d5cd5e15e2d89237e828f32b63f135. - - Closes #3204 - -Daniel Stenberg (31 Oct 2018) -- runtests: use the local curl for verifying - - ... revert the mistaken change brought in commit 8440616f53. - - Reported-by: Alessandro Ghedini - Bug: https://curl.haxx.se/mail/lib-2018-10/0118.html - - Closes #3198 - -Version 7.62.0 (30 Oct 2018) - -Daniel Stenberg (30 Oct 2018) -- RELEASE-NOTES: 7.62.0 - -- THANKS: 7.62.0 status - -Daniel Gustafsson (30 Oct 2018) -- vtls: add MesaLink to curl_sslbackend enum - - MesaLink support was added in commit 57348eb97d1b8fc3742e02c but the - backend was never added to the curl_sslbackend enum in curl/curl.h. - This adds the new backend to the enum and updates the relevant docs. - - Closes #3195 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -Daniel Stenberg (30 Oct 2018) -- [Ruslan Baratov brought this change] - - cmake: Remove unused CURL_CONFIG_HAS_BEEN_RUN_BEFORE variable - - Closes #3191 - -- test2080: verify the fix for CVE-2018-16842 - -- voutf: fix bad arethmetic when outputting warnings to stderr - - CVE-2018-16842 - Reported-by: Brian Carpenter - Bug: https://curl.haxx.se/docs/CVE-2018-16842.html - -- [Tuomo Rinne brought this change] - - cmake: uniform ZLIB to use USE_ variable and clean curl-config.cmake.in - - Closes #3123 - -- [Tuomo Rinne brought this change] - - cmake: add find_dependency call for ZLIB to CMake config file - -- [Tuomo Rinne brought this change] - - cmake: add support for transitive ZLIB target - -- unit1650: fix "null pointer passed as argument 1 to memcmp" - - Detected by UndefinedBehaviorSanitizer - - Closes #3187 - -- travis: add a "make tidy" build that runs clang-tidy - - Closes #3182 - -- unit1300: fix stack-use-after-scope AddressSanitizer warning - - Closes #3186 - -- Curl_auth_create_plain_message: fix too-large-input-check - - CVE-2018-16839 - Reported-by: Harry Sintonen - Bug: https://curl.haxx.se/docs/CVE-2018-16839.html - -- Curl_close: clear data->multi_easy on free to avoid use-after-free - - Regression from b46cfbc068 (7.59.0) - CVE-2018-16840 - Reported-by: Brian Carpenter (Geeknik Labs) - - Bug: https://curl.haxx.se/docs/CVE-2018-16840.html - -- [randomswdev brought this change] - - system.h: use proper setting with Sun C++ as well - - system.h selects the proper Sun settings when __SUNPRO_C is defined. The - Sun compiler does not define it when compiling C++ files. I'm adding a - check also on __SUNPRO_CC to allow curl to work properly also when used - in a C++ project on Sun Solaris. - - Closes #3181 - -- rand: add comment to skip a clang-tidy false positive - -- test1651: unit test Curl_extract_certinfo() - - The version used for Gskit, NSS, GnuTLS, WolfSSL and schannel. - -- x509asn1: always check return code from getASN1Element() - -- Makefile: add 'tidy' target that runs clang-tidy - - Available in the root, src and lib dirs. - - Closes #3163 - -- RELEASE-PROCEDURE: adjust the release dates - - See: https://curl.haxx.se/mail/lib-2018-10/0107.html - -Patrick Monnerat (27 Oct 2018) -- x509asn1: suppress left shift on signed value - - Use an unsigned variable: as the signed operation behavior is undefined, - this change silents clang-tidy about it. - - Ref: https://github.com/curl/curl/pull/3163 - Reported-By: Daniel Stenberg - -Michael Kaufmann (27 Oct 2018) -- multi: Fix error handling in the SENDPROTOCONNECT state - - If Curl_protocol_connect() returns an error code, - handle the error instead of switching to the next state. - - Closes #3170 - -Daniel Stenberg (27 Oct 2018) -- RELEASE-NOTES: synced - -- openssl: output the correct cipher list on TLS 1.3 error - - When failing to set the 1.3 cipher suite, the wrong string pointer would - be used in the error message. Most often saying "(nil)". - - Reported-by: Ricky-Tigg on github - Fixes #3178 - Closes #3180 - -- docs/CIPHERS: fix the TLS 1.3 cipher names - - ... picked straight from the OpenSSL man page: - https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set_ciphersuites.html - - Reported-by: Ricky-Tigg on github - Bug: #3178 - -Marcel Raad (27 Oct 2018) -- travis: install gnutls-bin package - - This is required for gnutls-serv, which enables a few more tests. - - Closes https://github.com/curl/curl/pull/2958 - -Daniel Gustafsson (26 Oct 2018) -- ssh: free the session on init failures - - Ensure to clear the session object in case the libssh2 initialization - fails. - - It could be argued that the libssh2 error function should be called to - get a proper error message in this case. But since the only error path - in libssh2_knownhost_init() is memory a allocation failure it's safest - to avoid since the libssh2 error handling allocates memory. - - Closes #3179 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -Daniel Stenberg (26 Oct 2018) -- docs/RELEASE-PROCEDURE: remove old entries, modify the Dec 2018 date - - ... I'm moving it up one week due to travels. The rest stays. - -- [Daniel Gustafsson brought this change] - - openssl: make 'done' a proper boolean - - Closes #3176 - -- gtls: Values stored to but never read - - Detected by clang-tidy - - Closes #3176 - -- [Alexey Eremikhin brought this change] - - curl.1: --ipv6 mutexes ipv4 (fixed typo) - - Fixes #3171 - Closes #3172 - -- tool_main: make TerminalSettings static - - Reported-by: Gisle Vanem - Bug: https://github.com/curl/curl/commit/becfe1233ff2b6b0c3e1b6a10048b55b68c2539f#commitcomment-31008819 - Closes #3161 - -- curl-config.in: remove dependency on bc - - Reported-by: Dima Pasechnik - Fixes #3143 - Closes #3174 - -- [Gisle Vanem brought this change] - - rtmp: fix for compiling with lwIP - - Compiling on _WIN32 and with USE_LWIPSOCK, causes this error: - curl_rtmp.c(223,3): error: use of undeclared identifier 'setsockopt' - setsockopt(r->m_sb.sb_socket, SOL_SOCKET, SO_RCVTIMEO, - ^ - curl_rtmp.c(41,32): note: expanded from macro 'setsockopt' - #define setsockopt(a,b,c,d,e) (setsockopt)(a,b,c,(const char *)d,(int)e) - ^ - Closes #3155 - -- configure: remove CURL_CONFIGURE_CURL_SOCKLEN_T - - Follow-up to #3166 which did the cmake part of this. This type/define is - not used. - - Closes #3168 - -- [Ruslan Baratov brought this change] - - cmake: remove unused variables - - Remove variables: - * HAVE_SOCKLEN_T - * CURL_SIZEOF_CURL_SOCKLEN_T - * CURL_TYPEOF_CURL_SOCKLEN_T - - Closes #3166 - -Michael Kaufmann (25 Oct 2018) -- urldata: Fix comment in header - - The "connecting" function is used by multiple protocols, not only FTP - -- netrc: free temporary strings if memory allocation fails - - - Change the inout parameters after all needed memory has been - allocated. Do not change them if something goes wrong. - - Free the allocated temporary strings if strdup() fails. - - Closes #3122 - -Daniel Stenberg (24 Oct 2018) -- [Ruslan Baratov brought this change] - - config: Remove unused SIZEOF_VOIDP - - Closes #3162 - -- RELEASE-NOTES: synced - -GitHub (23 Oct 2018) -- [Gisle Vanem brought this change] - - Fix for compiling with lwIP (3) - - lwIP on Windows does not have a WSAIoctl() function. - But it do have a SO_SNDBUF option to lwip_setsockopt(). But it currently does nothing. - -Daniel Stenberg (23 Oct 2018) -- Curl_follow: return better errors on URL problems - - ... by making the converter function global and accessible. - - Closes #3153 - -- Curl_follow: remove remaining free(newurl) - - Follow-up to 05564e750e8f0c. This function no longer frees the passed-in - URL. - - Reported-by: Michael Kaufmann - Bug: https://github.com/curl/curl/commit/05564e750e8f0c79016c680f301ce251e6e86155#commitcomm - ent-30985666 - -Daniel Gustafsson (23 Oct 2018) -- headers: end all headers with guard comment - - Most headerfiles end with a /* <headerguard> */ comment, but it was - missing from some. The comment isn't the most important part of our - code documentation but consistency has an intrinsic value in itself. - This adds header guard comments to the files that were lacking it. - - Closes #3158 - Reviewed-by: Jay Satiro <raysatiro@yahoo.com> - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -Jay Satiro (23 Oct 2018) -- CIPHERS.md: Mention the options used to set TLS 1.3 ciphers - - Closes https://github.com/curl/curl/pull/3159 - -Daniel Stenberg (20 Oct 2018) -- docs/BUG-BOUNTY: the sponsors actually decide the amount - - Retract the previous approach as the sponsors will be the ones to set the - final amounts. - - Closes #3152 - [ci skip] - -- multi: avoid double-free - - Curl_follow() no longer frees the string. Make sure it happens in the - caller function, like we normally handle allocations. - - This bug was introduced with the use of the URL API internally, it has - never been in a release version - - Reported-by: Dario Weißer - Closes #3149 - -- multi: make the closure handle "inherit" CURLOPT_NOSIGNAL - - Otherwise, closing that handle can still cause surprises! - - Reported-by: Martin Ankerl - Fixes #3138 - Closes #3147 - -Marcel Raad (19 Oct 2018) -- VS projects: add USE_IPV6 - - The Visual Studio builds didn't use IPv6. Add it to all projects since - Visual Studio 2008, which is verified to build via AppVeyor. - - Closes https://github.com/curl/curl/pull/3137 - -- config_win32: enable LDAPS - - As done in the autotools and CMake builds by default. - - Closes https://github.com/curl/curl/pull/3137 - -Daniel Stenberg (18 Oct 2018) -- travis: add build for "configure --disable-verbose" - - Closes #3144 - -Kamil Dudka (17 Oct 2018) -- tool_cb_hdr: handle failure of rename() - - Detected by Coverity. - - Closes #3140 - Reviewed-by: Jay Satiro - -Daniel Stenberg (17 Oct 2018) -- RELEASE-NOTES: synced - -- docs/SECURITY-PROCESS: the hackerone IBB program drops curl - - ... now there's only BountyGraph. - -Jay Satiro (16 Oct 2018) -- [Matthew Whitehead brought this change] - - x509asn1: Fix SAN IP address verification - - For IP addresses in the subject alternative name field, the length - of the IP address (and hence the number of bytes to perform a - memcmp on) is incorrectly calculated to be zero. The code previously - subtracted q from name.end. where in a successful case q = name.end - and therefore addrlen equalled 0. The change modifies the code to - subtract name.beg from name.end to calculate the length correctly. - - The issue only affects libcurl with GSKit SSL, not other SSL backends. - The issue is not a security issue as IP verification would always fail. - - Fixes #3102 - Closes #3141 - -Daniel Gustafsson (15 Oct 2018) -- INSTALL: mention mesalink in TLS section - - Commit 57348eb97d1b8fc3742e02c6587d2d02ff592da5 added support for the - MesaLink vtls backend, but missed updating the TLS section containing - supported backends in the docs. - - Closes #3134 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -Marcel Raad (14 Oct 2018) -- nonblock: fix unused parameter warning - - If USE_BLOCKING_SOCKETS is defined, curlx_nonblock's arguments are not - used. - -Michael Kaufmann (13 Oct 2018) -- Curl_follow: Always free the passed new URL - - Closes #3124 - -Viktor Szakats (12 Oct 2018) -- replace rawgit links [ci skip] - - Ref: https://rawgit.com/ "RawGit has reached the end of its useful life" - Ref: https://news.ycombinator.com/item?id=18202481 - Closes https://github.com/curl/curl/pull/3131 - -Daniel Stenberg (12 Oct 2018) -- docs/BUG-BOUNTY.md: for vulns published since Aug 1st 2018 - - [ci skip] - -- travis: make distcheck scan for BOM markers - - and remove BOM from projects/wolfssl_override.props - - Closes #3126 - -Marcel Raad (11 Oct 2018) -- CMake: remove BOM - - Accidentally aded in commit 1bb86057ff07083deeb0b00f8ad35879ec4d03ea. - - Reported-by: Viktor Szakats - Ref: https://github.com/curl/curl/pull/3120#issuecomment-428673136 - -Daniel Gustafsson (10 Oct 2018) -- transfer: fix typo in comment - -Michael Kaufmann (10 Oct 2018) -- docs: add "see also" links for SSL options - - - link TLS 1.2 and TLS 1.3 options - - link proxy and non-proxy options - - Closes #3121 - -Marcel Raad (10 Oct 2018) -- AppVeyor: remove BDIR variable that sneaked in again - - Removed in ae762e1abebe3a5fe75658583c85059a0957ef6e, accidentally added - again in 9f3be5672dc4dda30ab43e0152e13d714a84d762. - -- CMake: disable -Wpedantic-ms-format - - As done in the autotools build. This is required for MinGW, which - supports only %I64 for printing 64-bit values, but warns about it. - - Closes https://github.com/curl/curl/pull/3120 - -Viktor Szakats (9 Oct 2018) -- ldap: show precise LDAP call in error message on Windows - - Also add a unique but common text ('bind via') to make it - easy to grep this specific failure regardless of platform. - - Ref: https://github.com/curl/curl/pull/878/files#diff-7a636f08047c4edb53a240f540b4ecf6R468 - Closes https://github.com/curl/curl/pull/3118 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com> - -Daniel Stenberg (9 Oct 2018) -- docs/DEPRECATE: minor reformat to render nicer on web - -Daniel Gustafsson (9 Oct 2018) -- CURLOPT_SSL_VERIFYSTATUS: Fix typo - - Changes s/OSCP/OCSP/ and bumps the copyright year due to the change. - -Marcel Raad (9 Oct 2018) -- curl_setup: define NOGDI on Windows - - This avoids an ERROR macro clash between <wingdi.h> and <arpa/tftp.h> - on MinGW. - - Closes https://github.com/curl/curl/pull/3113 - -- Windows: fixes for MinGW targeting Windows Vista - - Classic MinGW has neither InitializeCriticalSectionEx nor - GetTickCount64, independent of the target Windows version. - - Closes https://github.com/curl/curl/pull/3113 - -Daniel Stenberg (8 Oct 2018) -- TODO: fixed 'API for URL parsing/splitting' - -Daniel Gustafsson (8 Oct 2018) -- KNOWN_BUGS: Fix various typos - - Closes #3112 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -Viktor Szakats (8 Oct 2018) -- spelling fixes [ci skip] - - as detected by codespell 1.14.0 - - Closes https://github.com/curl/curl/pull/3114 - Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com> - -Daniel Stenberg (8 Oct 2018) -- RELEASE-NOTES: synced - -- curl_ntlm_wb: check aprintf() return codes - - ... when they return NULL we're out of memory and MUST return failure. - - closes #3111 - -- docs/BUG-BOUNTY: proposed additional docs - - Bug bounty explainer. See https://bountygraph.com/programs/curl - - Closes #3067 - -- [Rick Deist brought this change] - - hostip: fix check on Curl_shuffle_addr return value - - Closes #3110 - -- FILE: fix CURLOPT_NOBODY and CURLOPT_HEADER output - - Now FILE transfers send headers to the header callback like HTTP and - other protocols. Also made curl_easy_getinfo(...CURLINFO_PROTOCOL...) - work for FILE in the callbacks. - - Makes "curl -i file://.." and "curl -I file://.." work like before - again. Applied the bold header logic to them too. - - Regression from c1c2762 (7.61.0) - - Reported-by: Shaun Jackman - Fixes #3083 - Closes #3101 - -Daniel Gustafsson (7 Oct 2018) -- gskit: make sure to terminate version string - - In case a very small buffer was passed to the version function, it could - result in the buffer not being NULL-terminated since strncpy() doesn't - guarantee a terminator on an overflowed buffer. Rather than adding code - to terminate (and handle zero-sized buffers), move to using snprintf() - instead like all the other vtls backends. - - Closes #3105 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - Reviewed-by: Viktor Szakats <commit@vszakats.net> - -- TODO: add LD_PRELOAD support on macOS - - Add DYLD_INSERT_LIBRARIES support to the TODO list. Reported in #2394. - -- runtests: skip ld_preload tests on macOS - - The LD_PRELOAD functionality doesn't exist on macOS, so skip any tests - requiring it. - - Fixes #2394 - Closes #3106 - Reported-by: Github user @jakirkham - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -Marcel Raad (7 Oct 2018) -- AppVeyor: use Debug builds to run tests - - This enables more tests. - - Closes https://github.com/curl/curl/pull/3104 - -- AppVeyor: add HTTP_ONLY build - - Closes https://github.com/curl/curl/pull/3104 - -- AppVeyor: add WinSSL builds - - Use the oldest and latest Windows SDKs for them. - Also, remove all but one OpenSSL build. - - Closes https://github.com/curl/curl/pull/3104 - -- AppVeyor: add remaining Visual Studio versions - - This adds Visual Studio 9 and 10 builds. - There's no 64-bit VC9 compiler on AppVeyor, so use it as the Win32 - build. Also, VC9 cannot be used for running the test suite. - - Closes https://github.com/curl/curl/pull/3104 - -- AppVeyor: break long line - - Closes https://github.com/curl/curl/pull/3104 - -- AppVeyor: remove unused BDIR variable - - Closes https://github.com/curl/curl/pull/3104 - -Daniel Stenberg (6 Oct 2018) -- test2100: test DoH using IPv4-only - - To make it only send one DoH request and avoid the race condition that - could lead to the requests getting sent in reversed order and thus - making it hard to compare in the test case. - - Fixes #3107 - Closes #3108 - -- tests/FILEFORMAT: mention how to use <fileN> and <stripfileN> too - - [ci skip] - -- RELEASE-NOTES: synced - -- [Dmitry Kostjuchenko brought this change] - - timeval: fix use of weak symbol clock_gettime() on Apple platforms - - Closes #3048 - -- doh: keep the IPv4 address in (original) network byte order - - Ideally this will fix the reversed order shown in SPARC tests: - - resp 8: Expected 127.0.0.1 got 1.0.0.127 - - Closes #3091 - -Jay Satiro (5 Oct 2018) -- INTERNALS.md: wrap lines longer than 79 - -Daniel Gustafsson (5 Oct 2018) -- INTERNALS: escape reference to parameter - - The parameter reference <string> was causing rendering issues in the - generated HTML page, as <string> isn't a valid HTML tag. Fix by back- - tick escaping it. - - Closes #3099 - Reviewed-by: Jay Satiro <raysatiro@yahoo.com> - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -- checksrc: handle zero scoped ignore commands - - If a !checksrc! disable command specified to ignore zero errors, it was - still added to the ignore block even though nothing was ignored. While - there were no blocks ignored that shouldn't be ignored, the processing - ended with with a warning: - - <filename>:<line>:<col>: warning: Unused ignore: LONGLINE (UNUSEDIGNORE) - /* !checksrc! disable LONGLINE 0 */ - ^ - Fix by instead treating a zero ignore as a a badcommand and throw a - warning for that one. - - Closes #3096 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -- checksrc: enable strict mode and warnings - - Enable strict and warnings mode for checksrc to ensure we aren't missing - anything due to bugs in the checking code. This uncovered a few things - which are all fixed in this commit: - - * several variables were used uninitialized - * several variables were not defined in the correct scope - * the whitelist filehandle was read even if the file didn't exist - * the enable_warn() call when a disable counter had expired was passing - incorrect variables, but since the checkwarn() call is unlikely to hit - (the counter is only decremented to zero on actual ignores) it didn't - manifest a problem. - - Closes #3090 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com> - -Marcel Raad (5 Oct 2018) -- CMake: suppress MSVC warning C4127 for libtest - - It's issued by older Windows SDKs (prior to version 8.0). - -Sergei Nikulov (5 Oct 2018) -- Merge branch 'dmitrykos-fix_missing_CMake_defines' - -- [Dmitry Kostjuchenko brought this change] - - cmake: test and set missed defines during configuration - - Added configuration checks for HAVE_BUILTIN_AVAILABLE and HAVE_CLOCK_GETTIME_MONOTONIC. - - Closes #3097 - -Marcel Raad (5 Oct 2018) -- AppVeyor: disable test 500 - - It almost always results in - "starttransfer vs total: 0.000001 0.000000". - I cannot reproduce this locally, so disable it for now. - - Closes https://github.com/curl/curl/pull/3100 - -- AppVeyor: set custom install prefix - - CMake's default has spaces and in 32-bit mode parentheses, which result - in syntax errors in curl-config. - - Closes https://github.com/curl/curl/pull/3100 - -- AppVeyor: Remove non-SSL non-test builds - - They don't add much value. - - Closes https://github.com/curl/curl/pull/3100 - -- AppVeyor: run test suite - - Use the preinstalled MSYS2 bash for that. - Disable test 1139 as the CMake build doesn't generate curl.1. - - Ref: https://github.com/curl/curl/issues/3070#issuecomment-425922224 - Closes https://github.com/curl/curl/pull/3100 - -- AppVeyor: use in-tree build - - Required to run the tests. - - Closes https://github.com/curl/curl/pull/3100 - -Daniel Stenberg (4 Oct 2018) -- doh: make sure TTL isn't re-inited by second (discarded?) response - - Closes #3092 - -- test320: strip out more HTML when comparing - - To make the test case work with different gnutls-serv versions better. - - Reported-by: Kamil Dudka - Fixes #3093 - Closes #3094 - -Marcel Raad (4 Oct 2018) -- runtests: use Windows paths for Windows curl - - curl generated by CMake's Visual Studio generator has "Windows" in the - version number. - -Daniel Stenberg (4 Oct 2018) -- [Colin Hogben brought this change] - - tests/negtelnetserver.py: fix Python2-ism in neg TELNET server - - Fix problems caused by differences in treatment of bytes objects between - python2 and python3. - - Fixes #2929 - Closes #3080 - -Daniel Gustafsson (3 Oct 2018) -- memory: ensure to check allocation results - - The result of a memory allocation should always be checked, as we may - run under memory pressure where even a small allocation can fail. This - adds checking and error handling to a few cases where the allocation - wasn't checked for success. In the ftp case, the freeing of the path - variable is moved ahead of the allocation since there is little point - in keeping it around across the strdup, and the separation makes for - more readable code. In nwlib, the lock is aslo freed in the error path. - - Also bumps the copyright years on affected files. - - Closes #3084 - Reviewed-by: Jay Satiro <raysatiro@yahoo.com> - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -- comment: Fix multiple typos in function parameters - - Ensure that the parameters in the comment match the actual names in the - prototype. - - Closes #3079 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -- CURLOPT_SSLVERSION.3: fix typos and consistent spelling - - Use TLS vX.Y throughout the document, instead of TLS X.Y, as that was - already done in all but a few cases. Also fix a few typos. - - Closes #3076 - Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com> - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -- SECURITY-PROCESS: make links into hyperlinks - - Use proper Markdown hyperlink format for the Bountygraph links in order - for the generated website page to be more user friendly. Also link to - the sponsors to give them a little extra credit. - - Closes #3082 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -Jay Satiro (3 Oct 2018) -- CURLOPT_HEADER.3: fix typo - -- nss: fix nssckbi module loading on Windows - - - Use .DLL extension instead of .so to load modules on Windows. - - Bug: https://curl.haxx.se/mail/lib-2018-09/0077.html - Reported-by: Maxime Legros - - Ref: https://github.com/curl/curl/pull/3016/#issuecomment-423069442 - - Closes https://github.com/curl/curl/pull/3086 - -- data-binary.d: clarify default content-type is x-www-form-urlencoded - - - Advise user that --data-binary sends a default content type of - x-www-form-urlencoded, and to have the data treated as arbitrary - binary data by the server set the content-type header to octet-stream. - - Ref: https://github.com/curl/curl/pull/2852#issuecomment-426465094 - - Closes https://github.com/curl/curl/pull/3085 - -Marcel Raad (2 Oct 2018) -- test1299: use single quotes around asterisk - - Ref: https://github.com/curl/curl/issues/1751#issuecomment-321522580 - -Daniel Stenberg (2 Oct 2018) -- docs/CIPHERS: mention the colon separation for OpenSSL - - Bug: #3077 - -- runtests: ignore disabled even when ranges are given - - runtests.pl support running a range of tests, like "44 to 127". Starting - now, the code makes sure that even such given ranges will ignore tests - that are marked as disabled. - - Disabled tests can still be run by explictly specifying that test - number. - - Closes #3075 - -- urlapi: starting with a drive letter on win32 is not an abs url - - ... and libcurl doesn't support any single-letter URL schemes (if there - even exist any) so it should be fairly risk-free. - - Reported-by: Marcel Raad - - Fixes #3070 - Closes #3071 - -Marcel Raad (2 Oct 2018) -- doh: fix curl_easy_setopt argument type - - CURLOPT_POSTFIELDSIZE is long. Fixes a compiler warning on 64-bit - MinGW. - -Daniel Stenberg (2 Oct 2018) -- RELEASE-NOTES: synced - -Jay Satiro (1 Oct 2018) -- [Ruslan Baratov brought this change] - - CMake: Improve config installation - - Use 'GNUInstallDirs' standard module to set destinations of installed - files. - - Use uppercase "CURL" names instead of lowercase "curl" to match standard - 'FindCURL.cmake' CMake module: - * https://cmake.org/cmake/help/latest/module/FindCURL.html - - Meaning: - * Install 'CURLConfig.cmake' instead of 'curl-config.cmake' - * User should call 'find_package(CURL)' instead of 'find_package(curl)' - - Use 'configure_package_config_file' function to generate - 'CURLConfig.cmake' file. This will make 'curl-config.cmake.in' template - file smaller and handle components better. E.g. current configuration - report no error if user specified unknown components (note: new - configuration expects no components, report error if user will try to - specify any). - - Closes https://github.com/curl/curl/pull/2849 - -Daniel Stenberg (1 Oct 2018) -- test1650: make it depend on http/2 - - Follow-up to 570008c99da0ccbb as it gets link errors. - - Reported-by: Michael Kaufmann - Closes #3068 - -- [Nate Prewitt brought this change] - - MANUAL: minor grammar fix - - Noticed a typo reading through the docs. - - Closes #3069 - -- doh: only build if h2 enabled - - The DoH spec says "HTTP/2 [RFC7540] is the minimum RECOMMENDED version - of HTTP for use with DoH". - - Reported-by: Marcel Raad - Closes #3066 - -- test2100: require http2 to run - - Reported-by: Marcel Raad - Fixes #3064 - Closes #3065 - -- multi: fix memory leak in content encoding related error path - - ... a missing multi_done() call. - - Credit to OSS-Fuzz - Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10728 - Closes #3063 - -- travis: bump the Secure Transport build to use xcode 10 - - Due to an issue with travis - (https://github.com/travis-ci/travis-ci/issues/9956) we've been using - Xcode 9.2 for darwinssl builds for a while. Now xcode 10 is offered as - an alternative and as it builds curl+darwinssl fine that seems like a - better choice. - - Closes #3062 - -- [Rich Turner brought this change] - - curl: enabled Windows VT Support and UTF-8 output - - Enabled Console VT support (if running OS supports VT) in tool_main.c. - - Fixes #3008 - Closes #3011 - -- multi: fix location URL memleak in error path - - Follow-up to #3044 - fix a leak OSS-Fuzz detected - Closes #3057 - -Sergei Nikulov (28 Sep 2018) -- cmake: fixed path used in generation of docs/tests during curl build through add_subdicectory(...) - -- [Brad King brought this change] - - cmake: Backport to work with CMake 3.0 again - - Changes in commit 7867aaa9a0 (cmake: link curl to the OpenSSL targets - instead of lib absolute paths, 2018-07-17) and commit f826b4ce98 (cmake: - bumped minimum version to 3.4, 2018-07-19) required CMake 3.4 to fix - issue #2746. This broke support for users on older versions of CMake - even if they just want to build curl and do not care whether transitive - dependencies work. - - Backport the logic to work with CMake 3.0 again by implementing the - fix only when the version of CMake is at least 3.4. - -Marcel Raad (27 Sep 2018) -- curl_threads: fix classic MinGW compile break - - Classic MinGW still has _beginthreadex's return type as unsigned long - instead of uintptr_t [0]. uintptr_t is not even defined because of [1]. - - [0] https://sourceforge.net/p/mingw/mingw-org-wsl/ci/wsl-5.1-release/tree/mingwrt/include/process.h#l167 - [1] https://sourceforge.net/p/mingw/mingw-org-wsl/ci/wsl-5.1-release/tree/mingwrt/include/process.h#l90 - - Bug: https://github.com/curl/curl/issues/2924#issuecomment-424334807 - Closes https://github.com/curl/curl/pull/3051 - -Daniel Stenberg (26 Sep 2018) -- configure: s/AC_RUN_IFELSE/CURL_RUN_IFELSE - - fix a few leftovers - - Fixes #3006 - Closes #3049 - -- [Doron Behar brought this change] - - example/htmltidy: fix include paths of tidy libraries - - Closes #3050 - -- RELEASE-NOTES: synced - -- Curl_http2_done: fix memleak in error path - - Free 'header_recvbuf' unconditionally even if 'h2' isn't (yet) set, for - early failures. - - Detected by OSS-Fuzz - - Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10669 - Closes #3046 - -- http: fix memleak in rewind error path - - If the rewind would fail, a strdup() would not get freed. - - Detected by OSS-Fuzz - - Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10665 - Closes #3044 - -Viktor Szakats (24 Sep 2018) -- test320: fix regression in [ci skip] - - The value in question is coming directly from `gnutls-serv`, so it cannot - be modified freely. - - Reported-by: Marcel Raad - Ref: https://github.com/curl/curl/commit/6ae6b2a533e8630afbb21f570305bd4ceece6348#commitcomment-30621004 - -Daniel Stenberg (24 Sep 2018) -- Curl_retry_request: fix memory leak - - Detected by OSS-Fuzz - - Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10648 - Closes #3042 - -- openssl: load built-in engines too - - Regression since 38203f1 - - Reported-by: Jean Fabrice - Fixes #3023 - Closes #3040 - -- [Christian Heimes brought this change] - - OpenSSL: enable TLS 1.3 post-handshake auth - - OpenSSL 1.1.1 requires clients to opt-in for post-handshake - authentication. - - Fixes: https://github.com/curl/curl/issues/3026 - Signed-off-by: Christian Heimes <christian@python.org> - - Closes https://github.com/curl/curl/pull/3027 - -- [Even Rouault brought this change] - - Curl_dedotdotify(): always nul terminate returned string. - - This fixes potential out-of-buffer access on "file:./" URL - - $ valgrind curl "file:./" - ==24516== Memcheck, a memory error detector - ==24516== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al. - ==24516== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info - ==24516== Command: /home/even/install-curl-git/bin/curl file:./ - ==24516== - ==24516== Conditional jump or move depends on uninitialised value(s) - ==24516== at 0x4C31F9C: strcmp (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) - ==24516== by 0x4EBB315: seturl (urlapi.c:801) - ==24516== by 0x4EBB568: parseurl (urlapi.c:861) - ==24516== by 0x4EBC509: curl_url_set (urlapi.c:1199) - ==24516== by 0x4E644C6: parseurlandfillconn (url.c:2044) - ==24516== by 0x4E67AEF: create_conn (url.c:3613) - ==24516== by 0x4E68A4F: Curl_connect (url.c:4119) - ==24516== by 0x4E7F0A4: multi_runsingle (multi.c:1440) - ==24516== by 0x4E808E5: curl_multi_perform (multi.c:2173) - ==24516== by 0x4E7558C: easy_transfer (easy.c:686) - ==24516== by 0x4E75801: easy_perform (easy.c:779) - ==24516== by 0x4E75868: curl_easy_perform (easy.c:798) - - Was originally spotted by - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10637 - Credit to OSS-Fuzz - - Closes #3039 - -Viktor Szakats (23 Sep 2018) -- update URLs in tests - - - and one in docs/MANUAL as well - - Closes https://github.com/curl/curl/pull/3038 - -- whitespace fixes - - - replace tabs with spaces where possible - - remove line ending spaces - - remove double/triple newlines at EOF - - fix a non-UTF-8 character - - cleanup a few indentations/line continuations - in manual examples - - Closes https://github.com/curl/curl/pull/3037 - -Daniel Stenberg (23 Sep 2018) -- http: add missing return code check - - Detected by Coverity. CID 1439610. - - Follow-up from 46e164069d1a523 - - Closes #3034 - -- ftp: don't access pointer before NULL check - - Detected by Coverity. CID 1439611. - - Follow-up from 46e164069d1a523 - -- unit1650: fix out of boundary access - - Fixes #2987 - Closes #3035 - -Viktor Szakats (23 Sep 2018) -- docs/examples: URL updates - - - also update two URLs outside of docs/examples - - fix spelling of filename persistant.c - - fix three long lines that started failing checksrc.pl - - Closes https://github.com/curl/curl/pull/3036 - -- examples/Makefile.m32: sync with core [ci skip] - - also: - - fix two warnings in synctime.c (one of them Windows-specific) - - upgrade URLs in synctime.c and remove a broken one - - Closes https://github.com/curl/curl/pull/3033 - -Daniel Stenberg (22 Sep 2018) -- examples/parseurl.c: show off the URL API a bit - - Closes #3030 - -- SECURITY-PROCESS: mention the bountygraph program [ci skip] - - Closes #3032 - -- url: use the URL API internally as well - - ... to make it a truly unified URL parser. - - Closes #3017 - -Viktor Szakats (22 Sep 2018) -- URL and mailmap updates, remove an obsolete directory [ci skip] - - Closes https://github.com/curl/curl/pull/3031 - -Daniel Stenberg (22 Sep 2018) -- RELEASE-NOTES: synced - -- configure: force-use -lpthreads on HPUX - - When trying to detect pthreads use on HPUX the checks will succeed - without the correct -l option but then end up failing at run-time. - - Reported-by: Eason-Yu on github - Fixes #2697 - Closes #3025 - -- [Erik Minekus brought this change] - - Curl_saferealloc: Fixed typo in docblock - - Closes #3029 - -- urlapi: fix support for address scope in IPv6 numerical addresses - - Closes #3024 - -- [Loganaden Velvindron brought this change] - - GnutTLS: TLS 1.3 support - - Closes #2971 - -- TODO: c-ares and CURLOPT_OPENSOCKETFUNCTION - - Removed DoH. - - Closes #2734 - -Jay Satiro (20 Sep 2018) -- vtls: fix ssl version "or later" behavior change for many backends - - - Treat CURL_SSLVERSION_MAX_NONE the same as - CURL_SSLVERSION_MAX_DEFAULT. Prior to this change NONE would mean use - the minimum version also as the maximum. - - This is a follow-up to 6015cef which changed the behavior of setting - the SSL version so that the requested version would only be the minimum - and not the maximum. It appears it was (mostly) implemented in OpenSSL - but not other backends. In other words CURL_SSLVERSION_TLSv1_0 used to - mean use just TLS v1.0 and now it means use TLS v1.0 *or later*. - - - Fix CURL_SSLVERSION_MAX_DEFAULT for OpenSSL. - - Prior to this change CURL_SSLVERSION_MAX_DEFAULT with OpenSSL was - erroneously treated as always TLS 1.3, and would cause an error if - OpenSSL was built without TLS 1.3 support. - - Co-authored-by: Daniel Gustafsson - - Fixes https://github.com/curl/curl/issues/2969 - Closes https://github.com/curl/curl/pull/3012 - -Daniel Stenberg (20 Sep 2018) -- certs: generate tests certs with sha256 digest algorithm - - As OpenSSL 1.1.1 starts to complain and fail on sha1 CAs: - - "SSL certificate problem: CA signature digest algorithm too weak" - - Closes #3014 - -- urlapi: document the error codes, remove two unused ones - - Assisted-by: Daniel Gustafsson - Closes #3019 - -- urlapi: add CURLU_GUESS_SCHEME and fix hostname acceptance - - In order for this API to fully work for libcurl itself, it now offers a - CURLU_GUESS_SCHEME flag that makes it "guess" scheme based on the host - name prefix just like libcurl always did. If there's no known prefix, it - will guess "http://". - - Separately, it relaxes the check of the host name so that IDN host names - can be passed in as well. - - Both these changes are necessary for libcurl itself to use this API. - - Assisted-by: Daniel Gustafsson - Closes #3018 - -Kamil Dudka (19 Sep 2018) -- nss: try to connect even if libnssckbi.so fails to load - - One can still use CA certificates stored in NSS database. - - Reported-by: Maxime Legros - Bug: https://curl.haxx.se/mail/lib-2018-09/0077.html - - Closes #3016 - -Daniel Gustafsson (19 Sep 2018) -- urlapi: don't set value which is never read - - In the CURLUPART_URL case, there is no codepath which invokes url - decoding so remove the assignment of the urldecode variable. This - fixes the deadstore bug-report from clang static analysis. - - Closes #3015 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -- todo: Update reference to already done item - - TODO item 1.1 was implemented in commit 946ce5b61f, update reference - to it with instead referencing the implemented option. - - Closes #3013 - Reviewed-by: Daniel Stenberg <daniel@haxx.se> - -Daniel Stenberg (18 Sep 2018) -- RELEASE-NOTES: synced - -- [slodki brought this change] - - cmake: don't require OpenSSL if USE_OPENSSL=OFF - - User must have OpenSSL installed even if not used by libcurl at all - since 7.61.1 release. Broken at - 7867aaa9a01decf93711428462335be8cef70212 - - Reviewed-by: Sergei Nikulov - Closes #3001 - -- curl_multi_wait: call getsock before figuring out timeout - - .... since getsock may update the expiry timer. - - Fixes #2996 - Closes #3000 - -- examples/http2-pushinmemory: receive HTTP/2 pushed files in memory - - Closes #3004 diff --git a/libs/libcurl/docs/THANKS b/libs/libcurl/docs/THANKS index 385ecd8518..73b84cfdb3 100644 --- a/libs/libcurl/docs/THANKS +++ b/libs/libcurl/docs/THANKS @@ -52,6 +52,7 @@ Alex Fishman Alex Grebenschikov Alex Gruz Alex Malinovich +Alex Mayorga Alex McLellan Alex Neblett Alex Nichols @@ -84,6 +85,7 @@ Alfonso Martone Alfred Gebert Allen Pulsifer Alona Rossen +Amit Katyal Amol Pattekar Amr Shahin Anatol Belski @@ -172,6 +174,7 @@ Ayoub Boudhar Balaji Parasuram Balaji S Rao Balaji Salunke +Balazs Kovacsics Balint Szilakszi Barry Abrahamson Bart Whiteley @@ -230,6 +233,7 @@ Brad King Brad Spencer Bradford Bruce Brandon Casey +Brandon Dong Brandon Wang Brendan Jurd Brent Beardsley @@ -261,6 +265,7 @@ Camille Moncelier Caolan McNamara Carie Pointer Carlo Cannas +Carlo Marcelo Arenas Belón Carlo Teubner Carlo Wood Carlos ORyan @@ -315,6 +320,7 @@ Clemens Gruber Cliff Crosland Clifford Wolf Clint Clayton +Clément Notin Cody Jones Cody Mack Colby Ranger @@ -714,6 +720,7 @@ Ian Wilkes Ignacio Vazquez-Abrams Igor Franchuk Igor Khristophorov +Igor Makarov Igor Novoseltsev Igor Polyakov Ihor Karpenko @@ -726,6 +733,7 @@ Ingmar Runge Ingo Ralf Blum Ingo Wilken Irfan Adilovic +Ironbars13 on github Irving Wolfe Isaac Boukris Isaiah Norton @@ -775,6 +783,7 @@ Jari Sundell Jason Baietto Jason Glasgow Jason Juang +Jason Lee Jason Liu Jason McDonald Jason S. Priebe @@ -809,6 +818,7 @@ Jens Schleusener Jeremie Rapin Jeremy Friesner Jeremy Huddleston +Jeremy Lainé Jeremy Lin Jeremy Pearson Jeremy Tan @@ -929,6 +939,7 @@ Julien Chaffraix Julien Nabet Julien Royer Jun-ichiro itojun Hagino +Junho Choi Jurij Smakov Juro Bystricky Justin Clift @@ -996,13 +1007,16 @@ Kristiyan Tsaklev Kristoffer Gleditsch Kunal Ekawde Kurt Fankhauser +Kyle Abramowitz Kyle Edwards Kyle J. McKay Kyle L. Huff Kyle Sallee +Kyohei Kadota Kyselgov E.N Lachlan O'Dea Ladar Levison +Lance Ware Larry Campbell Larry Fahnoe Larry Lin @@ -1207,6 +1221,7 @@ Michael Kaufmann Michael Kilburn Michael Kujawa Michael König +Michael Lee Michael Maltese Michael Mealling Michael Mueller @@ -1220,6 +1235,7 @@ Michael Wallner Michal Bonino Michal Marek Michal Trybus +Michal Čaplygin Michał Antoniak Michał Fita Michał Górny @@ -1549,6 +1565,7 @@ Roger Leigh Roland Blom Roland Krikava Roland Zimmermann +Rolf Eike Beer Rolland Dudemaine Romain Coltel Romain Fliedel @@ -1682,7 +1699,6 @@ Stephen Kick Stephen More Stephen Toub Sterling Hughes -Steve Brokenshire Steve Green Steve H Truong Steve Havelka @@ -1723,6 +1739,7 @@ Teemu Yli-Elsila Temprimus Terri Oda Terry Wu +The Infinnovation team TheAssassin on github Theodore Dubois Thomas Braun @@ -1736,6 +1753,7 @@ Thomas Petazzoni Thomas Ruecker Thomas Schwinge Thomas Tonino +Thomas Vegas Thomas van Hesteren Thorsten Schöning Tiit Pikma @@ -1921,6 +1939,7 @@ cbartl on github cclauss on github clbr on github cmfrolick on github +codesniffer13 on github d912e3 on github daboul on github dasimx on github @@ -1956,20 +1975,24 @@ madblobfish on github marc-groundctl on github masbug on github mccormickt12 on github +migueljcrum on github mkzero on github moohoorama on github nedres on github neex on github neheb on github nevv on HackerOne/curl +niallor on github nianxuejie on github niner on github nk nopjmp on github olesteban on github omau on github +osabc on github ovidiu-benea on github patelvivekv1993 on github +patnyb on github pendrek at hackerone pszemus on github silveja1 on github |