/
CHANGES.0
18002 lines (13835 loc) · 772 KB
/
CHANGES.0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
_ _ ____ _
___| | | | _ \| |
/ __| | | | |_) | |
| (__| |_| | _ <| |___
\___|\___/|_| \_\_____|
Old Changelog
Changes done to curl and libcurl from 1997 to 2010, edited manually. The most
recent changes are always generated into the CHANGES file straight from git.
Kamil Dudka (17 June 2010)
- Improve test575 in order to not fail with threaded DNS resolver.
Version 7.21.0 (16 June 2010)
Daniel Stenberg (5 June 2010)
- Constantine Sapuntzakis fixed a case of spurious SSL connection aborts using
libcurl and OpenSSL. "I tracked it down to uncleared error state on the
OpenSSL error stack - patch attached deals with that."
Daniel Stenberg (5 June 2010)
- Frank Meier added CURLINFO_PRIMARY_PORT, CURLINFO_LOCAL_IP and
CURLINFO_LOCAL_PORT to curl_easy_getinfo().
Yang Tse (4 June 2010)
- Enabled OpenLDAP support for cygwin builds. This support was disabled back
in 2008 due to incompatibilities between OpenSSL and OpenLDAP headers.
cygwin's OpenSSL 0.9.8l and OpenLDAP 2.3.43 versions on cygwin 1.5.25
allow building an OpenLDAP enabled libcurl supporting back to Windows 95.
Removed the non-functional CURL_LDAP_HYBRID code and references.
Daniel Stenberg (2 June 2010)
- Jason McDonald posted bug report #3006786 when he found that the SFTP code
didn't timeout properly in several places in the code even if a timeout was
set properly.
Based on his suggested patch, I wrote a different implementation that I
think addressed the issue better and also uses the connect timeout for the
initial part of the SSH/SFTP done during the "protocol connect" phase.
(http://curl.haxx.se/bug/view.cgi?id=3006786)
Yang Tse (2 June 2010)
- Added missing new libcurl files to non-configure targets. Adjusted
libcurl standard internal header inclusions in new files. Fixed an
SPNEGO related memory leak. Fixed several LDAP related compilation
issues, and fixed some compiler warnings.
Daniel Stenberg (1 June 2010)
- Igor Novoseltsev reported a problem with the multi socket API and using
timeouts and timers. It boiled down to a problem with libcurl's use of
GetTickCount() interally to figure out the current time, while Igor's own
application code used another function call.
It made his app call the socket API timeout function a bit _before_ libcurl
would consider the timeout to trigger, and that could easily lead to
timeouts or stalls in the app. It seems GetTickCount() in general often has
no better resolution than 16ms and switching to the alternative function
QueryPerformanceCounter has its share of problems:
http://www.virtualdub.org/blog/pivot/entry.php?id=106
We address this problem by simply having libcurl treat timers that already
has occured or will occur within 40ms subject for treatment. I'm confident
that there are other implementations and operating systems with similarly in
accurate timer functions so it makes sense to have applied generically and I
don't believe we sacrifice much by adding a 40ms inaccuracy on these
timeouts.
Kamil Dudka (27 May 2010)
- added a new test for CRL support (test313)
- Tor Arntsen changed the alternative definition of bool to use enum instead
of unsigned char.
Daniel Stenberg (25 May 2010)
- Julien Chaffraix fixed the warning seen when compiling lib/rtmp.c: one
unused variables, several unused arguments and some missing #include.
- Julien Chaffraix fixed 2 OOM errors: a missing NULL-check in
lib/http_negociate.c and a potential NULL dereferencing in lib/splay.c
- Howard Chu brought a patch that makes the LDAP code much cleaner, nicer and
in general being a better libcurl citizen. If a new enough OpenLDAP version
is detect, the new and shiny lib/openldap.c code is then used instead of the
old cruft.
Daniel Stenberg (21 May 2010)
- Eric Mertens posted bug #3003705: when we made TFTP use the correct timeout
option when sent to the server (fixed May 18th 2010) it became obvious that
libcurl used invalid timeout values (300 by default while the RFC allows
nothing above 255). While of course it is obvious that as TFTP has worked
thus far without being able to set timeout at all, just removing the setting
wouldn't make any difference in behavior. I decided to still keep it (but
fix the problem) as it now actually allows for easier (future) customization
of the timeout.
(http://curl.haxx.se/bug/view.cgi?id=3003705)
- Douglas Kilpatrick filed bug report #3004787 and pointed out that the TFTP
code didn't handle block id wraps correctly. His suggested fix inspired the
fix I committed.
(http://curl.haxx.se/bug/view.cgi?id=3004787)
Daniel Stenberg (20 May 2010)
- Tanguy Fautre brought a fix to allow curl to build with Microsoft VC10.
Daniel Stenberg (18 May 2010)
- Eric Mertens posted bug report #3003005 pointing out that the libcurl TFTP
code was not sending the timeout option properly to the server, and
suggested a fix.
(http://curl.haxx.se/bug/view.cgi?id=3003005)
Kamil Dudka (16 May 2010)
- Pavel Raiskup introduced a new option CURLOPT_FNMATCH_DATA in order to pass
a custom data pointer to the callback specified by CURLOPT_FNMATCH_FUNCTION.
Daniel Stenberg (14 May 2010)
- John-Mark Bell filed bug #3000052 that identified a problem (with an
associated patch) with the OpenSSL handshake state machine when the multi
interface is used:
Performing an https request using a curl multi handle and using select or
epoll to wait for events results in a hang. It appears that the cause is the
fix for bug #2958179, which makes ossl_connect_common unconditionally return
from the step 2 loop when fetching from a multi handle.
When ossl_connect_step2 has completed, it updates connssl->connecting_state
to ssl_connect_3. ossl_connect_common will then return to the caller, as a
multi handle is in use. Eventually, the client code will call
curl_multi_fdset to obtain an updated fdset to select or epoll on. For https
requests, curl_multi_fdset will cause https_getsock to be called.
https_getsock will only return a socket handle if the connecting_state is
ssl_connect_2_reading or ssl_connect_2_writing. Therefore, the client will
never obtain a valid fdset, and thus not drive the multi handle, resulting
in a hang.
(http://curl.haxx.se/bug/view.cgi?id=3000052)
- Sebastian V reported bug #3000056 identifying a problem with redirect
following. It showed that when curl followed redirects it didn't properly
ignore the response body of the 30X response if that response was using
compressed Content-Encoding!
(http://curl.haxx.se/bug/view.cgi?id=3000056)
Daniel Stenberg (12 May 2010)
- Howard Chu brought support for RTMP. This is powered by the underlying
librtmp library. It supports a range of variations and "sub-protocols"
within the RTMP family.
- Pavel Raiskup brought support for FTP directory wildcard matching to allow
selective downloading. To provide that, a set of new options were added:
CURLOPT_WILDCARDMATCH
CURLOPT_CHUNK_BGN_FUNCTION
CURLOPT_CHUNK_END_FUNCTION
CURLOPT_CHUNK_DATA
CURLOPT_FNMATCH_FUNCTION
There were also a set of new tests added (574 - 577) to verify this.
Kamil Dudka (11 May 2010)
- CRL support in libcurl-NSS has been completely broken. Now it works. Original
bug report: https://bugzilla.redhat.com/581926
Daniel Stenberg (7 May 2010)
- Dirk Manske reported a regression. When connecting with the multi interface,
there were situations where libcurl wouldn't store connect time correctly as
it used to (and is documented to) do.
Using his fine sample program we could repeat it, and I wrote up test case
573 using that code. The problem does not easily show itself using the local
test suite though.
The fix, also as suggested by Dirk, is a bit on the ugly side as it adds yet
another call to Curl_verboseconnect() and setting the TIMER_CONNECT time.
That situation is subject for some closer inspection in the future.
- Howard Chu split the I/O handling functions into private handlers.
Howard Chu brought the bulk work of this patch that properly moves out the
sending and recving of data to the parts of the code that are properly
responsible for the various ways of doing so.
Daniel Stenberg assisted with polishing a few bits and fixed some minor
flaws in the original patch.
Another upside of this patch is that we now abuse CURLcodes less with the
"magic" -1 return codes and instead use CURLE_AGAIN more consistently.
Daniel Stenberg (5 May 2010)
- Hoi-Ho Chan introduced support for using the PolarSSL library. You control
this with the new configure option --with-polarssl.
Daniel Stenberg (29 Apr 2010)
- Ben Greear made telnet a lot better/easier to use by an application:
The main change is to allow input from user-specified methods, when they are
specified with CURLOPT_READFUNCTION. All calls to fflush(stdout) in
telnet.c were removed, which makes using 'curl telnet://foo.com' painful
since prompts and other data are not always returned to the user promptly.
Use 'curl --no-buffer telnet://foo.com' instead. In general, the user
should have their CURLOPT_WRITEFUNCTION do a fflush for interactive use.
Also fix assumption that reading from stdin never returns < 0.
Old code could crash in that case.
Call progress functions in telnet main loop.
Daniel Stenberg (26 Apr 2010)
- Make use of the libssh2_init/exit functions that libssh2 added in version
1.2.5. Using them will improve how libcurl works in threaded situations when
SCP and SFTP are transfered.
Daniel Stenberg (25 Apr 2010)
- Based on work by Kamil Dudka, I've introduced the new configure option
--enable-threaded-resolver. When used, the configure script will check for
pthreads and if around, it will build libcurl to use pthreads to do name
resolving in a threaded manner. Note that this is just a fix to offer an
option that can enable the code that already included. The threader resolver
code was mostly added on Jan 26 2010.
Daniel Stenberg (24 Apr 2010)
- Alex Bligh introduced the --proto and -proto-redir options that limit what
protocols curl accepts for the requests and when following redirects.
Kamil Dudka (24 Apr 2010)
- Fixed test536 in order to not fail with threaded DNS resolver and tweaked
comments in certain examples using curl_multi_fdset().
- Fixed SSL handshake timeout underflow in libcurl-NSS, which caused test405
to hang on a slow machine.
Daniel Stenberg (21 Apr 2010)
- The -O option caused curl to crash on windows and DOS due to the tool
writing out of boundary memory.
Yang Tse (20 Apr 2010)
- Ruslan Gazizov detected that MSVC makefiles were using wsock32.lib instead
of ws2_32.lib, this generated linking issues on MSVC IPv6 enabled builds
that were done using those makefiles.
Daniel Stenberg (19 Apr 2010)
- -J/--remote-header-name didn't strip trailing carriage returns or linefeeds
properly, so they could be used in the file name.
Daniel Stenberg (16 Apr 2010)
- Jerome Vouillon made the GnuTLS SSL handshake phase non-blocking.
- The recent overhaul of the SSL recv function made the GnuTLS specific code
treat a zero returned from gnutls_record_recv() as an error, and this caused
our HTTPS test cases to fail. We leave it to upper layer code to detect if
an EOF is a problem or not.
- I reverted the resolver fix from yesterday and instead removed all uses of
AI_CANONNAME all over libcurl and made the only user of that info (krb5.c)
use the host name from the URL instead. No reverse resolving is a good
thing.
- Paul Howarth made configure properly detect GSS "on ancient Linux distros"
by editing in which order we use headers to detect GSS.
Daniel Stenberg (15 Apr 2010)
- Rainer Canavan filed bug report #2987196 that identified libcurl doing
unnecesary reverse name lookups in many cases when built to use IPv4 and
getaddrinfo(). The logic for ipv6 is now used for ipv4 too.
(http://curl.haxx.se/bug/view.cgi?id=2963679)
Version 7.20.1 (14 April 2010)
Daniel Stenberg (9 Apr 2010)
- Prefixing the FTP quote commands with an asterisk really only worked for the
postquote actions. This is now fixed and test case 227 has been extended to
verify.
Kamil Dudka (4 Apr 2010)
- Eliminated a race condition in Curl_resolv_timeout().
- Refactorized interface of Curl_ssl_recv()/Curl_ssl_send().
- libcurl-NSS now provides more accurate messages and error codes in case of
client certificate problem. Either during connection, or transfer phase.
Daniel Stenberg (1 Apr 2010)
- Matt Wixson found and fixed a bug in the SCP/SFTP area where the code
treated a 0 return code from libssh2 to be the same as EAGAIN while in
reality it isn't. The problem caused a hang in SFTP transfers from a
MessageWay server.
Daniel Stenberg (28 Mar 2010)
- Ben Greear: If you pass a URL to pop3 that does not contain a message ID as
part of the URL, it would previously ask for 'INBOX' which just causes the
pop3 server to return an error.
Now libcurl treats en empty message ID as a request for LIST (list of pop3
message IDs). User's code could then parse this and download individual
messages as desired.
Daniel Stenberg (27 Mar 2010)
- Ben Greear brought a patch that from now on allows all protocols to specify
name and user within the URL, in the same manner HTTP and FTP have been
allowed to in the past - although far from all of the libcurl supported
protocls actually have that feature in their URL definition spec.
Daniel Stenberg (26 Mar 2010)
- Ben Greear brought code that makes the rate limiting code for the easy
interface a bit smoother as it introduces sub-second sleeps during it and it
also takes the buffer sizes into account.
Daniel Stenberg (24 Mar 2010)
- Bob Richmond: There's an annoying situation where libcurl will read new HTTP
response data from a socket, then check if it's a timeout if one is set. If
the last packet received constitutes the end of the response body, libcurl
still treats it as a timeout condition and reports a message like:
"Operation timed out after 3000 milliseconds with 876 out of 876 bytes
received"
It should only a timeout if the timer lapsed and we DIDN'T receive the end
of the response body yet.
- Christopher Conroy fixed a problem with RTSP and GET_PARAMETER reported
to us by Massimo Callegari. There's a new test case 572 that verifies this
now.
- The 'ares' subtree has been removed from the source repository. It was
always a separate project that sort of piggybacked on the curl project since
the dawn of times and now the time has come for it to go stand on its own
legs and continue living its own life. All details on c-ares and its new
source code repository is found at http://c-ares.haxx.se/
Daniel Stenberg (23 Mar 2010)
- Kenny To filed the bug report #2963679 with patch to fix a problem he
experienced with doing multi interface HTTP POST over a proxy using
PROXYTUNNEL. He found a case where it would connect fine but bits.tcpconnect
was not set correct so libcurl didn't work properly.
(http://curl.haxx.se/bug/view.cgi?id=2963679)
- Akos Pasztory filed debian bug report #572276
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572276 mentioning a problem
with a resource that returns chunked-encoded _and_ with a Content-Length
and libcurl failed to properly ignore the latter information.
- Hauke Duden provided an example program that made the multi interface crash.
His example simply used the multi interface and did first one FTP transfer
and after completion it used a second easy handle and did another FTP
transfer on the same FTP server.
This triggered a bug in the "delayed easy handle kill" system that curl
uses: when an FTP connection is left alive it must keep an easy handle
around internally - only for the purpose of having an easy handle when it
later disconnects it. The code assumed that when the easy handle was removed
and an internal reference was made, that version could be killed later on
when a new easy handle came using the same connection. This was wrong as
Hauke's example showed that the removed handle wasn't killed for real until
later. This caused a double close attempt => segfault.
Daniel Stenberg (22 Mar 2010)
- Thomas Lopatic fixed the alarm()-based DNS timeout:
Looking at the code of Curl_resolv_timeout() in hostip.c, I think that in
case of a timeout, the signal handler for SIGALRM never gets removed. I
think that in my case it gets executed at some point later on when execution
has long left Curl_resolv_timeout() or even the cURL library.
The code that is jumped to with siglongjmp() simply sets the error message
to "name lookup timed out" and then returns with CURLRESOLV_ERROR. I guess
that instead of simply returning without cleaning up, the code should have a
goto that jumps to the spot right after the call to Curl_resolv().
Kamil Dudka (22 Mar 2010)
- Douglas Steinwand contributed a patch fixing insufficient initialization in
Curl_clone_ssl_config()
Daniel Stenberg (21 Mar 2010)
- Ben Greear improved TFTP: the error code returning and the treatment
of TSIZE == 0 when uploading.
- We've switched from CVS to git. See http://curl.haxx.se/source.html
Kamil Dudka (19 Mar 2010)
- Improved Curl_read() to not ignore the error returned from Curl_ssl_recv().
Daniel Stenberg (15 Mar 2010)
- Constantine Sapuntzakis brought a patch:
The problem mentioned on Dec 10 2009
(http://curl.haxx.se/bug/view.cgi?id=2905220) was only partially fixed.
Partially because an easy handle can be associated with many connections in
the cache (e.g. if there is a redirect during the lifetime of the easy
handle). The previous patch only cleaned up the first one. The new fix now
removes the easy handle from all connections, not just the first one.
Daniel Stenberg (6 Mar 2010)
- Ben Greear brought a patch that fixed the rate limiting logic for TFTP when
the easy interface was used.
Daniel Stenberg (5 Mar 2010)
- Daniel Johnson provided fixes for building curl with the clang compiler.
Yang Tse (5 Mar 2010)
- Constantine Sapuntzakis detected and fixed a double free in builds done
with threaded resolver enabled (Windows default configuration) that would
get triggered when a curl handle is closed while doing DNS resolution.
Daniel Stenberg (2 Mar 2010)
- [Daniel Johnson] I've been trying to build libcurl with clang on Darwin and
ran into some issues with the GSSAPI tests in configure.ac. The tests first
try to determine the include dirs and libs and set CPPFLAGS and LIBS
accordingly. It then checks for the headers and finally sets LIBS a second
time, causing the libs to be included twice. The first setting of LIBS seems
redundant and should be left out, since the first part is otherwise just
about finding headers.
My second issue is that 'krb5-config --libs gssapi' on Darwin is less than
useless and returns junk that, while it happens to work with gcc, causes
clang to choke. For example, --libs returns $CFLAGS along with the libs,
which is really retarded. Simply setting 'LIBS="$LIBS -lgssapi_krb5
-lresolv"' on Darwin is sufficient.
- Based on patch provided by Jacob Moshenko, the transfer logic now properly
makes sure that when using sub-second timeouts, there's no final bad 1000ms
wait. Previously, a sub-second timeout would often make the elapsed time end
up the time rounded up to the nearest second (e.g. 1s for 200ms timeout)
- Andrei Benea filed bug report #2956698 and pointed out that the
CURLOPT_CERTINFO feature leaked memory due to a missing OpenSSL function
call. He provided the patch to fix it too.
http://curl.haxx.se/bug/view.cgi?id=2956698
- Markus Duft pointed out in bug #2961796 that even though Interix has a
poll() function it doesn't quite work the way we want it so we must disable
it, and he also provided a patch for it.
http://curl.haxx.se/bug/view.cgi?id=2961796
- Made the pingpong timeout code properly deal with the response timeout AND
the global timeout if set. Also, as was reported in the bug report #2956437
by Ryan Chan, the time stamp to use as basis for the per command timeout was
not set properly in the DONE phase for FTP (and not for SMTP) so I fixed
that just now. This was a regression compared to 7.19.7 due to the
conversion of FTP code over to the generic pingpong concepts.
http://curl.haxx.se/bug/view.cgi?id=2956437
Daniel Stenberg (1 Mar 2010)
- Ben Greear provided an update for TFTP that fixes upload.
- Wesley Miaw reported bug #2958179 which identified a case of looping during
OpenSSL based SSL handshaking even though the multi interface was used and
there was no good reason for it.
http://curl.haxx.se/bug/view.cgi?id=2958179
Daniel Stenberg (26 Feb 2010)
- Pat Ray in bug #2958474 pointed out an off-by-one case when receiving a
chunked-encoding trailer.
http://curl.haxx.se/bug/view.cgi?id=2958474
Daniel Fandrich (25 Feb 2010)
- Fixed a couple of out of memory leaks and a segfault in the SMTP & IMAP code.
Yang Tse (25 Feb 2010)
- I fixed bug report #2958074 indicating
(http://curl.haxx.se/bug/view.cgi?id=2958074) that curl on Windows with
option --trace-time did not use local time when timestamping trace lines.
This could also happen on other systems depending on time souurce.
Patrick Monnerat (22 Feb 2010)
- Proper handling of STARTTLS on SMTP, taking CURLUSESSL_TRY into account.
- SMTP falls back to RFC821 HELO when EHLO fails (and SSL is not required).
- Use of true local host name (i.e.: via gethostname()) when available, as
default argument to SMTP HELO/EHLO.
- Test case 804 for HELO fallback.
Daniel Stenberg (20 Feb 2010)
- Fixed the SMTP compliance by making sure RCPT TO addresses are specified
properly in angle brackets. Recipients provided with CURLOPT_MAIL_RCPT now
get angle bracket wrapping automatically by libcurl unless the recipient
starts with an angle bracket as then the app is assumed to deal with that
properly on its own.
- I made the SMTP code expect a 250 response back from the server after the
full DATA has been sent, and I modified the test SMTP server to also send
that response. As usual, the DONE operation that is made after a completed
transfer is still not doable in a non-blocking way so this waiting for 250
is unfortunately made blockingly.
Yang Tse (14 Feb 2010)
- Overhauled test suite getpart() function. Fixing potential out of bounds
stack and memory overwrites triggered with huge test case definitions.
Daniel Stenberg (13 Feb 2010)
- Martin Hager reported and fixed a problem with a missing quote in libcurl.m4
(http://curl.haxx.se/bug/view.cgi?id=2951319)
- Tom Donovan fixed the CURL_FORMAT_* defines when building with cmake.
(http://curl.haxx.se/bug/view.cgi?id=2951269)
Daniel Stenberg (12 Feb 2010)
- Jack Zhang reported a problem with SMTP: we wrongly used multiple addresses
in the same RCPT TO line, when they should be sent in separate single
commands. I updated test case 802 to verify this.
- I also fixed a bad use of my_setopt_str() of CURLOPT_MAIL_RCPT in the curl
tool which made it try to output it as string for the --libcurl feature
which could lead to crashes.
Yang Tse (11 Feb 2010)
- Steven M. Schweda fixed VMS builder bad behavior when used in a batch job,
removed obsolete batch_compile.com and defines.com and updated VMS readme.
Version 7.20.0 (9 February 2010)
Daniel Stenberg (9 Feb 2010)
- When downloading compressed content over HTTP and the app asked libcurl to
automatically uncompress it with the CURLOPT_ENCODING option, libcurl could
wrongly provide the callback with more data than the maximum documented
amount. An application could thus get tricked into badness if the maximum
limit was trusted to be enforced by libcurl itself (as it is documented).
This is further detailed and explained in the libcurl security advisory
20100209 at
http://curl.haxx.se/docs/adv_20100209.html
Daniel Fandrich (3 Feb 2010)
- Changed the Watcom makefiles to make them easier to keep in sync with
Makefile.inc since that can't be included directly.
Yang Tse (2 Feb 2010)
- Symbol CURL_FORMAT_OFF_T now obsoleted, will be removed in a future release,
symbol will not be available when building with CURL_NO_OLDIES defined. Use
of CURL_FORMAT_CURL_OFF_T is preferred since 7.19.0
Daniel Stenberg (1 Feb 2010)
- Using the multi_socket API, it turns out at times it seemed to "forget"
connections (which caused a hang). It turned out to be an existing (7.19.7)
bug in libcurl (that's been around for a long time) and it happened like
this:
The app calls curl_multi_add_handle() to add a new easy handle, libcurl will
then set it to timeout in 1 millisecond so libcurl will tell the app about
it.
The app's timeout fires off that there's a timeout, the app calls libcurl as
we so often document it:
do {
res = curl_multi_socket_action(... TIMEOUT ...);
} while(CURLM_CALL_MULTI_PERFORM == res);
And this is the problem number one:
When curl_multi_socket_action() is called with no specific handle, but only
a timeout-action, it will *only* perform actions within libcurl that are
marked to run at this time. In this case, the request would go from INIT to
CONNECT and return CURLM_CALL_MULTI_PERFORM. When the app then calls libcurl
again, there's no timer set for this handle so it remains in the CONNECT
state. The CONNECT state is a transitional state in libcurl so it reports no
sockets there, and thus libcurl never tells the app anything more about that
easy handle/connection.
libcurl _does_ set a 1ms timeout for the handle at the end of
multi_runsingle() if it returns CURLM_CALL_MULTI_PERFORM, but since the loop
is instant the new job is not ready to run at that point (and there's no
code that makes libcurl call the app to update the timout for this new
timeout). It will simply rely on that some other timeout will trigger later
on or that something else will update the timeout callback. This makes the
bug fairly hard to repeat.
The fix made to adress this issue:
We introduce a loop in lib/multi.c around all calls to multi_runsingle() and
simply check for CURLM_CALL_MULTI_PERFORM internally. This has the added
benefit that this goes in line with my long-term wishes to get rid of the
CURLM_CALL_MULTI_PERFORM all together from the public API.
The downside of this fix, is that the counter we return in 'running_handles'
in several of our public functions then gets a slightly new and possibly
confusing behavior during times:
If an app adds a handle that fails to connect (very quickly) it may just
as well never appear as a 'running_handle' with this fix. Previously it
would first bump the counter only to get it decreased again at next call.
Even I have used that change in handle counter to signal "end of a
transfer". The only *good* way to find the end of a individual transfer
is calling curl_multi_info_read() to see if it returns one.
Of course, if the app previously did the looping before it checked the
counter, it really shouldn't be any new effect.
Yang Tse (26 Jan 2010)
- Constantine Sapuntzakis' and Joshua Kwan's work done in the last four months
relative to the asynchronous DNS lookups, along with with some integration
adjustments I have done are finally committed to CVS.
Currently these enhancements will benefit builds done using c-ares on any
platform as well as Windows builds using the default threaded resolver.
This release does not make generally available POSIX threaded DNS lookups
yet. There is no configure option to enable this feature yet. It is possible
to experimantally try this feature running configure with compiler flags that
make simultaneous definition of preprocessor symbols USE_THREADS_POSIX and
HAVE_PTHREAD_H, as well as whatever reentrancy compiler flags and linker ones
are required to link and properly use pthread_* functions on each platform.
Daniel Stenberg (26 Jan 2010)
- Mike Crowe made libcurl return CURLE_COULDNT_RESOLVE_PROXY when it is the
proxy that cannot be resolved when using c-ares. This matches the behaviour
when not using c-ares.
Björn Stenberg (23 Jan 2010)
- Added a new flag: -J/--remote-header-name. This option tells the
-O/--remote-name option to use the server-specified Content-Disposition
filename instead of extracting a filename from the URL.
Daniel Stenberg (21 Jan 2010)
- Chris Conroy brought support for RTSP transfers, and with it comes 8(!) new
libcurl options for controlling what to get and how to receive posssibly
interleaved RTP data.
Daniel Stenberg (20 Jan 2010)
- As was pointed out on the http-state mailing list, the order of cookies in a
HTTP Cookie: header _needs_ to be sorted on the path length in the cases
where two cookies using the same name are set more than once using
(overlapping) paths. Realizing this, identically named cookies must be
sorted correctly. But detecting only identically named cookies and take care
of them individually is harder than just to blindly and unconditionally sort
all cookies based on their path lengths. All major browsers also already do
this, so this makes our behavior one step closer to them in the cookie area.
Test case 8 was the only one that broke due to this change and I updated it
accordingly.
Daniel Stenberg (19 Jan 2010)
- David McCreedy brought a fix and a new test case (129) to make libcurl work
again when downloading files over FTP using ASCII and it turns out that the
final size of the file is not the same as the initial size the server
reported. This is very common since servers don't take the newline
conversions into account.
Kamil Dudka (14 Jan 2010)
- Suppressed side effect of OpenSSL configure checks, which prevented NSS from
being properly detected under certain circumstances. It had been caused by
strange behavior of pkg-config when handling PKG_CONFIG_LIBDIR. pkg-config
distinguishes among empty and non-existent environment variable in that case.
Daniel Stenberg (12 Jan 2010)
- Gil Weber reported a peculiar flaw with the multi interface when doing SFTP
transfers: curl_multi_fdset() would return -1 and not set and file
descriptors several times during a transfer of a single file. It turned out
to be due to two different flaws now fixed. Gil's excellent recipe helped me
nail this.
Daniel Stenberg (11 Jan 2010)
- Made sure that the progress callback is repeatedly called at a regular
interval even during very slow connects.
- The tests/runtests.pl script now checks to see if the test case that runs is
present in the tests/data/Makefile.am and outputs a notice message on the
screen if not. Each test file has to be included in that Makefile.am to get
included in release archives and forgetting to add files there is a common
mistake. This is an attempt to make it harder to forget.
Daniel Stenberg (9 Jan 2010)
- Johan van Selst found and fixed a OpenSSL session ref count leak:
ossl_connect_step3() increments an SSL session handle reference counter on
each call. When sessions are re-used this reference counter may be
incremented many times, but it will be decremented only once when done (by
Curl_ossl_session_free()); and the internal OpenSSL data will not be freed
if this reference count remains positive. When a session is re-used the
reference counter should be corrected by explicitly calling
SSL_SESSION_free() after each consecutive SSL_get1_session() to avoid
introducing a memory leak.
(http://curl.haxx.se/bug/view.cgi?id=2926284)
Daniel Stenberg (7 Jan 2010)
- Make sure the progress callback is called repeatedly even during very slow
name resolves when c-ares is used for resolving.
Claes Jakobsson (6 Jan 2010)
- Julien Chaffraix fixed so that the fragment part in an URL is not sent
to the server anymore.
Kamil Dudka (3 Jan 2010)
- Julien Chaffraix eliminated a duplicated initialization in singlesocket().
Daniel Stenberg (2 Jan 2010)
- Make curl support --ssl and --ssl-reqd instead of the previous FTP-specific
versions --ftp-ssl and --ftp-ssl-reqd as these options are now used to
control SSL/TLS for IMAP, POP3 and SMTP as well in addition to FTP. The old
option names are still working but the new ones are the ones listed and
documented.
Daniel Stenberg (1 Jan 2010)
- Ingmar Runge enhanced libcurl's FTP engine to support the PRET command. This
command is a special "hack" used by the drftpd server, but even though it is
a custom extension I've deemed it fine to add to libcurl since this server
seems to survive and people keep using it and want libcurl to support
it. The new libcurl option is named CURLOPT_FTP_USE_PRET, and it is also
usable from the curl tool with --ftp-pret. Using this option on a server
that doesn't support this command will make libcurl fail.
I added test cases 1107 and 1108 to verify the functionality.
The PRET command is documented at
http://www.drftpd.org/index.php/Distributed_PASV
Yang Tse (30 Dec 2009)
- Steven M. Schweda improved VMS build system, and Craig A. Berry helped
with the patch and testing.
Daniel Stenberg (26 Dec 2009)
- Renato Botelho and Peter Pentchev brought a patch that makes the libcurl
headers work correctly even on FreeBSD systems before v8.
(http://curl.haxx.se/bug/view.cgi?id=2916915)
Daniel Stenberg (17 Dec 2009)
- David Byron fixed Curl_ossl_cleanup to actually call ENGINE_cleanup when
available.
- Follow-up fix for the proxy fix I did for Jon Nelson's bug. It turned out I
was a bit too quick and broke test case 1101 with that change. The order of
some of the setups is sensitive. I now changed it slightly again to make
sure we do them in this order:
1 - parse URL and figure out what protocol is used in the URL
2 - prepend protocol:// to URL if missing
3 - parse name+password off URL, which needs to know what protocol is used
(since only some allows for name+password in the URL)
4 - figure out if a proxy should be used set by an option
5 - if no proxy option, check proxy environment variables
6 - run the protocol-specific setup function, which needs to have the proxy
already set
Daniel Stenberg (15 Dec 2009)
- Jon Nelson found a regression that turned out to be a flaw in how libcurl
detects and uses proxies based on the environment variables. If the proxy
was given as an explicit option it worked, but due to the setup order
mistake proxies would not be used fine for a few protocols when picked up
from '[protocol]_proxy'. Obviously this broke after 7.19.4. I now also added
test case 1106 that verifies this functionality.
(http://curl.haxx.se/bug/view.cgi?id=2913886)
Daniel Stenberg (12 Dec 2009)
- IMAP, POP3 and SMTP support and their TLS versions (including IMAPS, POP3S
and SMTPS) are now supported. The current state may not yet be solid, but
the foundation is in place and the test suite has some initial support for
these protocols. Work will now persue to make them nice libcurl citizens
until release.
The work with supporting these new protocols was sponsored by
networking4all.com - thanks!
Daniel Stenberg (10 Dec 2009)
- Siegfried Gyuricsko found out that the curl manual said --retry would retry
on FTP errors in the transient 5xx range. Transient FTP errors are in the
4xx range. The code itself only tried on 5xx errors that occured _at login_.
Now the retry code retries on all FTP transfer failures that ended with a
4xx response.
(http://curl.haxx.se/bug/view.cgi?id=2911279)
- Constantine Sapuntzakis figured out a case which would lead to libcurl
accessing alredy freed memory and thus crash when using HTTPS (with
OpenSSL), multi interface and the CURLOPT_DEBUGFUNCTION and a certain order
of cleaning things up. I fixed it.
(http://curl.haxx.se/bug/view.cgi?id=2905220)
Daniel Stenberg (7 Dec 2009)
- Martin Storsjo made libcurl use the Expect: 100-continue header for posts
with unknown size. Previously it was only used for posts with a known size
larger than 1024 bytes.
Daniel Stenberg (1 Dec 2009)
- If the Expect: 100-continue header has been set by the application through
curl_easy_setopt with CURLOPT_HTTPHEADER, the library should set
data->state.expect100header accordingly - the current code (in 7.19.7 at
least) doesn't handle this properly. Martin Storsjo provided the fix!
Yang Tse (28 Nov 2009)
- Added Diffie-Hellman parameters to several test harness certificate files in
PEM format. Required by several stunnel versions used by our test harness.
Daniel Stenberg (28 Nov 2009)
- Markus Koetter provided a polished and updated version of Chad Monroe's TFTP
rework patch that now integrates TFTP properly into libcurl so that it can
be used non-blocking with the multi interface and more. BLKSIZE also works.
The --tftp-blksize option was added to allow setting the TFTP BLKSIZE from
the command line.
Daniel Stenberg (26 Nov 2009)
- Extended and fixed the change I did on Dec 11 for the the progress
meter/callback during FTP command/response sequences. It turned out it was
really lame before and now the progress meter SHOULD get called at least
once per second.
Daniel Stenberg (23 Nov 2009)
- Bjorn Augustsson reported a bug which made curl not report any problems even
though it failed to write a very small download to disk (done in a single
fwrite call). It turned out to be because fwrite() returned success, but
there was insufficient error-checking for the fclose() call which tricked
curl to believe things were fine.
Yang Tse (23 Nov 2009)
- David Byron modified Makefile.dist vc8 and vc9 targets in order to allow
finer granularity control when generating src and lib makefiles.
Yang Tse (22 Nov 2009)
- I modified configure to force removal of the curlbuild.h file included in
distribution tarballs for use by non-configure systems. As intended, this
would get overwriten when doing in-tree builds. But VPATH builds would end
having two curlbuild.h files, one in the source tree and another in the
build tree. With the modification I introduced 5 Nov 2009 this could become
an issue when running libcurl's test suite.
Daniel Stenberg (20 Nov 2009)
- Constantine Sapuntzakis identified a write after close, as the sockets were
closed by libcurl before the SSL lib were shutdown and they may write to its
socket. Detected to at least happen with OpenSSL builds.
- Jad Chamcham pointed out a bug with connection re-use. If a connection had
CURLOPT_HTTPPROXYTUNNEL enabled over a proxy, a subsequent request using the
same proxy with the tunnel option disabled would still wrongly re-use that
previous connection and the outcome would only be badness.
Yang Tse (18 Nov 2009)
- I modified the memory tracking system to make it intolerant with zero sized
malloc(), calloc() and realloc() function calls.
Daniel Stenberg (17 Nov 2009)
- Constantine Sapuntzakis provided another fix for the DNS cache that could
end up with entries that wouldn't time-out:
1. Set up a first web server that redirects (307) to a http://server:port
that's down
2. Have curl connect to the first web server using curl multi
After the curl_easy_cleanup call, there will be curl dns entries hanging
around with in_use != 0.
(http://curl.haxx.se/bug/view.cgi?id=2891591)
- Marc Kleine-Budde fixed: curl saved the LDFLAGS set during configure into
its pkg-config file. So -Wl stuff ended up in the .pc file, which is really
bad, and breaks if there are multiple -Wl in our LDFLAGS (which are in
PTXdist). bug #2893592 (http://curl.haxx.se/bug/view.cgi?id=2893592)
Kamil Dudka (15 Nov 2009)
- David Byron improved the configure script to use pkg-config to find OpenSSL
(and in particular the list of required libraries) even if a path is given
as argument to --with-ssl
Yang Tse (15 Nov 2009)
- I removed enable-thread / disable-thread configure option. These were only
placebo options. The library is always built as thread safe as possible on
every system.
Claes Jakobsson (14 Nov 2009)
- curl-config now accepts '--configure' to see what arguments was
passed to the configure script when building curl.
Daniel Stenberg (14 Nov 2009)
- Claes Jakobsson restored the configure functionality to detect NSS when
--with-nss is set but not "yes".
I think we can still improve that to check for pkg-config in that path etc,
but at least this patch brings back the same functionality we had before.
- Camille Moncelier added support for the file type SSL_FILETYPE_ENGINE for
the client certificate. It also disable the key name test as some engines
can select a private key/cert automatically (When there is only one key
and/or certificate on the hardware device used by the engine)
Yang Tse (14 Nov 2009)
- Constantine Sapuntzakis provided the fix that ensures that an SSL connection
won't be reused unless protection level for peer and host verification match.
I refactored how preprocessor symbol _THREAD_SAFE definition is done.
Kamil Dudka (12 Nov 2009)
- Kevin Baughman provided a fix preventing libcurl-NSS from crash on doubly
closed NSPR descriptor. The issue was hard to find, reported several times
before and always closed unresolved. More info at the RH bug:
https://bugzilla.redhat.com/534176
- libcurl-NSS now tries to reconnect with TLS disabled in case it detects
a broken TLS server. However it does not happen if SSL version is selected
manually. The approach was originally taken from PSM. Kaspar Brand helped me
to complete the patch. Original bug reports:
https://bugzilla.redhat.com/525496
https://bugzilla.redhat.com/527771
Yang Tse (12 Nov 2009)
- I modified configure script to make the getaddrinfo function check also
verify if the function is thread safe.
Yang Tse (11 Nov 2009)
- Marco Maggi reported that compilation failed when configured --with-gssapi
and GNU GSS installed due to a missing mutual exclusion of header files in
the Kerberos 5 code path. He also verified that my patch worked for him.
Daniel Stenberg (11 Nov 2009)
- Constantine Sapuntzakis posted bug #2891595
(http://curl.haxx.se/bug/view.cgi?id=2891595) which identified how an entry
in the DNS cache would linger too long if the request that added it was in
use that long. He also provided the patch that now makes libcurl capable of
still doing a request while the DNS hash entry may get timed out.
- Christian Schmitz noticed that the progress meter/callback was not properly
used during the FTP connection phase (after the actual TCP connect), while
it of course should be. I also made the speed check get called correctly so
that really slow servers will trigger that properly too.
Kamil Dudka (5 Nov 2009)
- Dropped misleading timeouts in libcurl-NSS and made sure the SSL socket works
in non-blocking mode.
Yang Tse (5 Nov 2009)
- I removed leading 'curl' path on the 'curlbuild.h' include statement in
curl.h, adjusting auto-makefiles include path, to enhance portability to
OS's without an orthogonal directory tree structure such as OS/400.
Daniel Stenberg (4 Nov 2009)
- I fixed several problems with the transfer progress meter. It showed the
wrong percentage for small files, most notable for <1000 bytes and could
easily end up showing more than 100% at the end. It also didn't show any
percentage, transfer size or estimated transfer times when transferring
less than 100 bytes.
Version 7.19.7 (4 November 2009)
Daniel Stenberg (2 Nov 2009)
- As reported independent by both Stan van de Burgt and Didier Brisebourg,
CURLINFO_SIZE_DOWNLOAD (the -w variable size_download) didn't work when
getting data from ldap!
Daniel Stenberg (31 Oct 2009)
- Gabriel Kuri reported a problem with CURLINFO_CONTENT_LENGTH_DOWNLOAD if the
download was 0 bytes, as libcurl would then return the size as unknown (-1)
and not 0. I wrote a fix and test case 566 to verify it.
Daniel Stenberg (30 Oct 2009)
- Liza Alenchery mentioned a problem with re-used SCP connection when a bad
auth is used, as it caused a crash. I failed to repeat the issue, but still
made a change that now forces the TCP connection used for a freed SCP
session to get closed and not be re-used.
- "Tom" posted a bug report that mentioned how libcurl did wrong when doing a
POST using a read callback, with Digest authentication and
"Transfer-Encoding: chunked" enforced. I would then cause the first request
to be wrongly sent and then basically hang until the server closed the
connection. I fixed the problem and added test case 565 to verify it.
Daniel Stenberg (25 Oct 2009)
- Dima Barsky made the curl cookie parser accept cookies even with blank or
unparsable expiry dates and then treat them as session cookies - previously
libcurl would reject cookies with a date format it couldn't parse. Research
shows that the major browser treat such cookies as session cookies. I
modified test 8 and 31 to verify this.
Daniel Stenberg (21 Oct 2009)
- Attempt to use pkg-config for finding out libssh2 installation details
during configure.
- A patch in bug report #2883177 (http://curl.haxx.se/bug/view.cgi?id=2883177)
by Johan van Selst introduced the --crlfile option to curl, which makes curl
tell libcurl about a file with CRL (certificate revocation list) data to
read.
Daniel Stenberg (18 Oct 2009)
- Ray Dassen provided a patch in Debian's bug tracker (bug number #551461)
that now makes curl_getdate(3) actually handles RFC 822 formatted dates that
use the "single letter military timezones".
http://www.rfc-ref.org/RFC-TEXTS/822/chapter5.html has the details.
- Fixed memory leak in the SCP/SFTP code as it never freed the knownhosts
data!
- John Dennis filed bug report #2873666
(http://curl.haxx.se/bug/view.cgi?id=2873666) which identified a problem
which made libcurl loop infinitely when given incorrect credentials when
using HTTP GSS negotiate authentication. He also provided a small and simple