Recent Activity in the repo

Fixed a problem in smtp_done() when writing out the postdata as Curl_write() would periodically return zero bytes written.

M lib/smtp.c

With commit 035ef06bda7 applied, the test pop3 server needs to send ".\r\n" as the body terminating sequence and there needs to be a final CRLF in the actual body in the test data file.

M tests/data/test1319
M tests/data/test800
M tests/ftpserver.pl

Curl_smtp_escape_eob() would leave off final CRLFs from emails ending in multiple blank lines additionally leaving the smtpc->eob variable with the character count in, which would cause problems for additional emails when sent through multiple calls to curl_easy_perform() after a CURLOPT_CONNECT_ONLY.

M lib/smtp.c

M docs/curl.1

Added an extra command-line argument to support the optional AUTH parameter in SMTPs MAIL FROM command.

M src/tool_cfgable.c
M src/tool_cfgable.h
M src/tool_getparam.c
M src/tool_help.c
M src/tool_operate.c

Added information relating to the new CURLOPT_MAIL_AUTH parameter and reworked CURLOPT_MAIL_FROM and CURLOPT_MAIL_RCPT to be a clearer.

Fixed inconsistencies of "vocalisation of the abbreviation" versus "vocalisation of the first word" for all abbreviations.

Corrected a typo in CURLOPT_NOPROXY.

M docs/libcurl/curl_easy_setopt.3

Added a new CURLOPT_MAIL_AUTH option that allows the calling program to set the optional AUTH parameter in the MAIL FROM command.

When this option is specified and an authentication mechanism is used to communicate with the mail server then the AUTH parameter will be included in the MAIL FROM command. This is particularly useful when the calling program is acting as a relay in a trusted environment and performing server to server communication, as it allows the relaying server to specify the address of the mailbox that was used to authenticate and send the original email.

M include/curl/curl.h
M lib/smtp.c
M lib/url.c
M lib/urldata.h

I accidentally left the lowest bits 01 before

M include/curl/curlver.h

We will go straight to 7.25.0 due to the new additions

M docs/libcurl/curl_easy_setopt.3
M docs/libcurl/symbols-in-versions

9 bug fixes, 4 changes and numerous contributors

Bumped release version and option counters

M RELEASE-NOTES

Fix the str2num() function to not check if the input string starts with a digit, since strtol() supports numbers prepended with '-' (and '+') too. This makes the --max-redirs option work as documented.

M src/tool_paramhlp.c

The proxy parser function strips off trailing slashes off the proxy name which could lead to a mistaken zero length proxy name which would be treated as no proxy at all by subsequent functions!

This is now detected and an error is returned. Verified by the new test 1329.

Reported by: Chandrakant Bagul Bug: http://curl.haxx.se/mail/lib-2012-02/0000.html

M lib/url.c
M tests/data/Makefile.am
A tests/data/test1329

M configure.ac

Allow an appliction to set libcurl specific SSL options. The first and only options supported right now is CURLSSLOPT_ALLOW_BEAST.

It will make libcurl to disable any work-arounds the underlying SSL library may have to address a known security flaw in the SSL3 and TLS1.0 protocol versions.

This is a reaction to us unconditionally removing that behavior after this security advisory:

http://curl.haxx.se/docs/adv_20120124B.html

... it did however cause a lot of programs to fail because of old servers not liking this work-around. Now programs can opt to decrease the security in order to interoperate with old servers better.

M docs/libcurl/curl_easy_setopt.3
M docs/libcurl/symbols-in-versions
M include/curl/curl.h
M lib/ssluse.c
M lib/url.c
M lib/urldata.h

This adds three new options to control the behavior of TCP keepalives:

- CURLOPT_TCP_KEEPALIVE: enable/disable probes - CURLOPT_TCP_KEEPIDLE: idle time before sending first probe - CURLOPT_TCP_KEEPINTVL: delay between successive probes

While not all operating systems support the TCP_KEEPIDLE and TCP_KEEPINTVL knobs, the library will still allow these options to be set by clients, silently ignoring the values.

M docs/libcurl/curl_easy_setopt.3
M docs/libcurl/symbols-in-versions
M include/curl/curl.h
M lib/connect.c
M lib/url.c
M lib/urldata.h

This prevents clobbering of non recoverable error return codes while retaining intended functionality of commit 65103efe

M src/tool_operate.c

When the target host was given as a IPv6 numerical address, it was not properly put within square brackets for the Host: header in the CONNECT request. The "normal" request did fine.

Reported by: "zooloo" Bug: http://curl.haxx.se/bug/view.cgi?id=3482093

M lib/http_proxy.c

When connecting to a domain with multiple IP addresses, allow different, decreasing connection timeout values. This should guarantee some connections attempts with sufficiently long timeouts, while still providing fallback.

M lib/connect.c

M TODO-RELEASE

M tests/stunnel.pem

M docs/libcurl/curl_easy_setopt.3

With advice from Nikos Mavrogiannopoulos, changed the priority string to add "actual priorities" and favour ARCFOUR. This makes libcurl work better when enforcing SSLv3 with GnuTLS. Both in the sense that the libmicrohttpd test is now working again but also that it mitigates a weakness in the older SSL/TLS protocols.

Bug: http://curl.haxx.se/mail/lib-2012-01/0225.html Reported by: Christian Grothoff

M lib/gtls.c

Protocols (IMAP, POP3 and SMTP) that use the path part of a URL in a decoded manner now use the new Curl_urldecode() function to reject URLs with embedded control codes (anything that is or decodes to a byte value less than 32).

URLs containing such codes could easily otherwise be used to do harm and allow users to do unintended actions with otherwise innocent tools and applications. Like for example using a URL like pop3://pop3.example.com/1%0d%0aDELE%201 when the app wants a URL to get a mail and instead this would delete one.

This flaw is considered a security vulnerability: CVE-2012-0036

Security advisory at: http://curl.haxx.se/docs/adv_20120124.html

Reported by: Dan Fandrich

M lib/escape.c
M lib/escape.h
M lib/imap.c
M lib/pop3.c
M lib/smtp.c

3 more bugfixes, 3 more contributors

M RELEASE-NOTES

M docs/examples/README

M lib/telnet.c

avoid checking preprocessor definition official value

M lib/ssluse.c

As is pointed out in this bug report, there can indeed be situation where --stderr has a point even when the "real" stderr can be redirected. Remove the superfluous and wrong comment.

bug: http://curl.haxx.se/bug/view.cgi?id=3476020

M docs/curl.1

M lib/share.c
M lib/share.h
M lib/sslgen.c
M lib/sslgen.h
M lib/transfer.c
M lib/url.c
M lib/urldata.h

The value was turned negative when it shouldn't have been

M lib/polarssl.c

5 more bug fixes, 1 more contributor

M RELEASE-NOTES

Remove wrongly implemented optimisation of telnet upload, apparently intended to allow the library to avoid manually polling for input.

M src/tool_operate.c

bug: http://curl.haxx.se/bug/view.cgi?id=3474308

M lib/openldap.c

SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option enabling allowed successfull interoperability with web server Netscape Enterprise Server 2.0.1 released back in 1996 more than 15 years ago.

Due to CVE-2010-4180, option SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG has become ineffective as of OpenSSL 0.9.8q and 1.0.0c. In order to mitigate CVE-2010-4180 when using previous OpenSSL versions we no longer enable this option regardless of OpenSSL version and SSL_OP_ALL definition.

M lib/ssluse.c

Allows tests from the libtest subdir to generate log traces similar to those of curl with --tracetime and --trace-ascii options but with output going to stderr.

A tests/libtest/testtrace.c
A tests/libtest/testtrace.h

M lib/connect.c
M lib/curl_ntlm_msgs.c
M lib/cyassl.c
M lib/dict.c
M lib/ftp.c
M lib/gtls.c
M lib/http_negotiate.c
M lib/transfer.c
M lib/url.c

Just showing how to download the contents of a given URL into a local file.

Based on a suggestion and example code by Georg Potthast

M docs/examples/.gitignore
M docs/examples/Makefile.inc
A docs/examples/url2file.c

M tests/server/sws.c

M lib/http_proxy.c

M lib/http_negotiate_sspi.c
M lib/warnless.c
M lib/warnless.h

M tests/server/sws.c

Some functions using getaddrinfo and gethostbyname were still mistakingly being used/linked even if c-ares was selected as resolver backend.

Reported by: Arthur Murray Bug: http://curl.haxx.se/mail/lib-2012-01/0160.html

M lib/hostip4.c
M lib/setup.h
M lib/tftp.c

Test 161 updated accordingly

M lib/ftp.c
M tests/data/test161

M lib/setup.h

M tests/server/Makefile.inc
M tests/server/sws.c

Previously the code would create a dummy socket while resolving just to have curl_multi_fdset() return something but the non-win32 version doesn't do it this way and the creation and use of a socket that isn't made with the common create-socket callback can be confusing to apps using the multi_socket API etc.

This change removes the dummy socket and thus will cause curl_multi_fdset() to return with maxfd == -1 more often.

M lib/asyn-thread.c

M tests/data/test1320
M tests/data/test1321

M tests/server/sws.c

M lib/krb5.c