Recent Activity in the repo

When the target host was given as a IPv6 numerical address, it was not properly put within square brackets for the Host: header in the CONNECT request. The "normal" request did fine.

Reported by: "zooloo" Bug: http://curl.haxx.se/bug/view.cgi?id=3482093

M lib/http_proxy.c

When connecting to a domain with multiple IP addresses, allow different, decreasing connection timeout values. This should guarantee some connections attempts with sufficiently long timeouts, while still providing fallback.

M lib/connect.c

M TODO-RELEASE

M tests/stunnel.pem

M docs/libcurl/curl_easy_setopt.3

With advice from Nikos Mavrogiannopoulos, changed the priority string to add "actual priorities" and favour ARCFOUR. This makes libcurl work better when enforcing SSLv3 with GnuTLS. Both in the sense that the libmicrohttpd test is now working again but also that it mitigates a weakness in the older SSL/TLS protocols.

Bug: http://curl.haxx.se/mail/lib-2012-01/0225.html Reported by: Christian Grothoff

M lib/gtls.c

Protocols (IMAP, POP3 and SMTP) that use the path part of a URL in a decoded manner now use the new Curl_urldecode() function to reject URLs with embedded control codes (anything that is or decodes to a byte value less than 32).

URLs containing such codes could easily otherwise be used to do harm and allow users to do unintended actions with otherwise innocent tools and applications. Like for example using a URL like pop3://pop3.example.com/1%0d%0aDELE%201 when the app wants a URL to get a mail and instead this would delete one.

This flaw is considered a security vulnerability: CVE-2012-0036

Security advisory at: http://curl.haxx.se/docs/adv_20120124.html

Reported by: Dan Fandrich

M lib/escape.c
M lib/escape.h
M lib/imap.c
M lib/pop3.c
M lib/smtp.c

3 more bugfixes, 3 more contributors

M RELEASE-NOTES

M docs/examples/README

M lib/telnet.c

avoid checking preprocessor definition official value

M lib/ssluse.c

As is pointed out in this bug report, there can indeed be situation where --stderr has a point even when the "real" stderr can be redirected. Remove the superfluous and wrong comment.

bug: http://curl.haxx.se/bug/view.cgi?id=3476020

M docs/curl.1

M lib/share.c
M lib/share.h
M lib/sslgen.c
M lib/sslgen.h
M lib/transfer.c
M lib/url.c
M lib/urldata.h

The value was turned negative when it shouldn't have been

M lib/polarssl.c

5 more bug fixes, 1 more contributor

M RELEASE-NOTES

Remove wrongly implemented optimisation of telnet upload, apparently intended to allow the library to avoid manually polling for input.

M src/tool_operate.c

bug: http://curl.haxx.se/bug/view.cgi?id=3474308

M lib/openldap.c

SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option enabling allowed successfull interoperability with web server Netscape Enterprise Server 2.0.1 released back in 1996 more than 15 years ago.

Due to CVE-2010-4180, option SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG has become ineffective as of OpenSSL 0.9.8q and 1.0.0c. In order to mitigate CVE-2010-4180 when using previous OpenSSL versions we no longer enable this option regardless of OpenSSL version and SSL_OP_ALL definition.

M lib/ssluse.c

Allows tests from the libtest subdir to generate log traces similar to those of curl with --tracetime and --trace-ascii options but with output going to stderr.

A tests/libtest/testtrace.c
A tests/libtest/testtrace.h

M lib/connect.c
M lib/curl_ntlm_msgs.c
M lib/cyassl.c
M lib/dict.c
M lib/ftp.c
M lib/gtls.c
M lib/http_negotiate.c
M lib/transfer.c
M lib/url.c

Just showing how to download the contents of a given URL into a local file.

Based on a suggestion and example code by Georg Potthast

M docs/examples/.gitignore
M docs/examples/Makefile.inc
A docs/examples/url2file.c

M tests/server/sws.c

M lib/http_proxy.c

M lib/http_negotiate_sspi.c
M lib/warnless.c
M lib/warnless.h

M tests/server/sws.c

Some functions using getaddrinfo and gethostbyname were still mistakingly being used/linked even if c-ares was selected as resolver backend.

Reported by: Arthur Murray Bug: http://curl.haxx.se/mail/lib-2012-01/0160.html

M lib/hostip4.c
M lib/setup.h
M lib/tftp.c

Test 161 updated accordingly

M lib/ftp.c
M tests/data/test161

M lib/setup.h

M tests/server/Makefile.inc
M tests/server/sws.c

Previously the code would create a dummy socket while resolving just to have curl_multi_fdset() return something but the non-win32 version doesn't do it this way and the creation and use of a socket that isn't made with the common create-socket callback can be confusing to apps using the multi_socket API etc.

This change removes the dummy socket and thus will cause curl_multi_fdset() to return with maxfd == -1 more often.

M lib/asyn-thread.c

M tests/data/test1320
M tests/data/test1321

M tests/server/sws.c

M lib/krb5.c

Fixed a problem in POP3 and IMAP where a connection would fail when CURLUSESSL_TRY was specified for a server that didn't support SSL/TLS connections rather than continuing.

M lib/imap.c
M lib/pop3.c

M docs/libcurl/curl_easy_setopt.3

M tests/data/Makefile.am
A tests/data/test1319
A tests/data/test1320
A tests/data/test1321

M docs/libcurl/curl_easy_strerror.3

M lib/hostip.c

Unfortunately we have no test cases for this and I have no SSPI build or server to verify this with. The change seems simple enough though.

Bug: http://curl.haxx.se/bug/view.cgi?id=3466497 Reported by: Patrice Guerin

M lib/http_negotiate_sspi.c

M lib/ssh.c

6 more bugfixes, 3 more contributors

M RELEASE-NOTES

When a HTTP connection is re-used for a subsequent request without proxy, it would always re-use the Host: header of the first request. As host names are case insensitive it would make curl send another host name case that what the particular request used.

Now it will instead always use the most recent host name to always use the desired casing.

Added test case 1318 to verify.

Bug: http://curl.haxx.se/mail/lib-2011-12/0314.html Reported by: Alex Vinnik

M lib/url.c
M tests/data/Makefile.am
A tests/data/test1318

M tests/README
M tests/runtests.pl

These examples show how to fetch a single message (RETR command) and how to list all the messages in a given mailbox (LIST command), with authentication via SSL.

They were both based on the https.c example.

A docs/examples/pop3s.c
A docs/examples/pop3slist.c

M CHANGES.0
M CMake/FindCARES.cmake
M CMakeLists.txt
M docs/INSTALL
M docs/examples/Makefile.m32
M docs/examples/version-check.pl
M lib/Makefile.m32
M lib/libcurl.plist
M log2changes.pl
M perl/contrib/checklinks.pl.in
M perl/contrib/crawlink.pl
M perl/contrib/getlinks.pl.in
M src/Makefile.Watcom
M src/Makefile.m32
M tests/libtest/first.c
M tests/runtests.pl
M tests/symbol-scan.pl
M tests/unit/README

Initial step in order to allow our pingpong server to better support arbitrary application data splitting among TCP packets. This first commit only addresses reasembly of data that sockfilter processes reads from soockets and pingpong server later reads from sockfilters stdout.

M tests/ftpserver.pl

M tests/testcurl.pl

The commit 9dd85bc unintentionally changed the way we compute the time spent waiting for 100-continue. In particular, when using a SSL client certificate, the time spent by SSL handshake was included and could cause the CURL_TIMEOUT_EXPECT_100 timeout to be mistakenly fired up.

Bug: https://bugzilla.redhat.com/767490 Reported by: Mamoru Tasaka

M RELEASE-NOTES
M lib/transfer.c

M lib/hash.c