1curl and libcurl 7.68.0 2 3 Public curl releases: 188 4 Command line options: 229 5 curl_easy_setopt() options: 269 6 Public functions in libcurl: 82 7 Contributors: 2088 8 9This release includes the following changes: 10 11 o TLS: add BearSSL vtls implementation [37] 12 o XFERINFOFUNCTION: support CURL_PROGRESSFUNC_CONTINUE [36] 13 o curl: add --etag-compare and --etag-save [31] 14 o curl: add --parallel-immediate [29] 15 o multi: add curl_multi_wakeup() [38] 16 o openssl: CURLSSLOPT_NO_PARTIALCHAIN can disable partial cert chains [45] 17 18This release includes the following bugfixes: 19 20 o CVE-2019-15601: file: on Windows, refuse paths that start with \\ [106] 21 o Azure Pipelines: add several builds 22 o CMake: add support for building with the NSS vtls backend [43] 23 o CURL-DISABLE: initial docs for the CURL_DISABLE_* defines [19] 24 o CURLOPT_HEADERFUNCTION.3: Document that size is always 1 [100] 25 o CURLOPT_QUOTE.3: fix typos [78] 26 o CURLOPT_READFUNCTION.3: fix the example [107] 27 o CURLOPT_URL.3: "curl supports SMB version 1 (only)" 28 o CURLOPT_VERBOSE.3: see also ERRORBUFFER 29 o HISTORY: added cmake, HTTP/3 and parallel downloads with curl 30 o HISTORY: the SMB(S) support landed in 2014 31 o INSTALL.md: provide Android build instructions [10] 32 o KNOWN_BUGS: Connection information when using TCP Fast Open [85] 33 o KNOWN_BUGS: LDAP on Windows doesn't work correctly [86] 34 o KNOWN_BUGS: TLS session cache doesn't work with TFO [56] 35 o OPENSOCKETFUNCTION.3: correct the purpose description [48] 36 o TrackMemory tests: always remove CR before LF [111] 37 o altsvc: bump to h3-24 [6] 38 o altsvc: make the save function ignore NULL filenames [67] 39 o build: Disable Visual Studio warning "conditional expression is constant" [49] 40 o build: fix for CURL_DISABLE_DOH [2] 41 o checksrc.bat: Add a check for vquic and vssh directories [40] 42 o checksrc: repair the copyrightyear check [25] 43 o cirrus-ci: enable clang sanitizers on freebsd 13 [60] 44 o cirrus: Drop the FreeBSD 10.4 build 45 o config-win32: cpu-machine-OS for Windows on ARM [13] 46 o configure: avoid unportable `==' test(1) operator [1] 47 o configure: enable IPv6 support without `getaddrinfo` [44] 48 o configure: fix typo in help text [4] 49 o conncache: CONNECT_ONLY connections assumed always in-use [71] 50 o conncache: fix multi-thread use of shared connection cache [61] 51 o copyrights: fix copyright year range [25] 52 o create_conn: prefer multiplexing to using new connections [76] 53 o curl -w: handle a blank input file correctly [105] 54 o curl.h: add two missing defines for "pre ISO C" compilers [75] 55 o curl/parseconfig: fix mem-leak [81] 56 o curl/parseconfig: use curl_free() to free memory allocated by libcurl [80] 57 o curl: cleanup multi handle on failure [103] 58 o curl: fix --upload-file . hangs if delay in STDIN [35] 59 o curl: fix -T globbing [16] 60 o curl: improved cleanup in upload error path [69] 61 o curl: make a few char pointers point to const char instead [95] 62 o curl: properly free mimepost data [104] 63 o curl: show better error message when no homedir is found [47] 64 o curl: show error for --http3 if libcurl lacks support [108] 65 o curl_setup_once: consistently use WHILE_FALSE in macros [54] 66 o define: remove HAVE_ENGINE_LOAD_BUILTIN_ENGINES, not used anymore [83] 67 o docs: Change 'experiemental' to 'experimental' [30] 68 o docs: TLS SRP doesn't work with TLS 1.3 [87] 69 o docs: fix several typos [62] 70 o docs: mention CURL_MAX_INPUT_LENGTH restrictions [109] 71 o doh: improved both encoding and decoding [11] 72 o doh: make it behave when built without proxy support [68] 73 o examples/postinmemory.c: Call curl_global_cleanup always [101] 74 o examples/url2file.c: corrected erroneous comment [102] 75 o examples: add multi-poll.c [14] 76 o global_init: undo the "intialized" bump in case of failure [52] 77 o hostip: suppress compiler warning [64] 78 o http_ntlm: Remove duplicate NSS initialisation [55] 79 o lib: Move lib/ssh.h -> lib/vssh/ssh.h [9] 80 o lib: fix compiler warnings with `CURL_DISABLE_VERBOSE_STRINGS` [93] 81 o lib: fix warnings found when porting to NuttX [99] 82 o lib: remove ASSIGNWITHINCONDITION exceptions, use our code style [84] 83 o lib: remove erroneous +x file permission on some c files [99] 84 o libssh2: add support for ECDSA and ed25519 knownhost keys [89] 85 o multi.h: remove INITIAL_MAX_CONCURRENT_STREAMS from public header [110] 86 o multi: free sockhash on OOM [63] 87 o multi_poll: avoid busy-loop when called without easy handles attached [15] 88 o ngtcp2: Support the latest update key callback type [92] 89 o ngtcp2: fix thread-safety bug in error-handling [33] 90 o ngtcp2: free used resources on disconnect [7] 91 o ngtcp2: handle key updates as ngtcp2 master branch tells us [8] 92 o ngtcp2: increase QUIC window size when data is consumed [12] 93 o ngtcp2: use overflow buffer for extra HTTP/3 data [5] 94 o ntlm: USE_WIN32_CRYPTO check removed to get USE_NTLM2SESSION set [3] 95 o ntlm_wb: fix double-free in OOM [65] 96 o openssl: Revert to less sensitivity for SYSCALL errors [26] 97 o openssl: improve error message for SYSCALL during connect [27] 98 o openssl: prevent recursive function calls from ctx callbacks [18] 99 o openssl: retrieve reported LibreSSL version at runtime [50] 100 o openssl: set X509_V_FLAG_PARTIAL_CHAIN by default [46] 101 o parsedate: offer a getdate_capped() alternative [53] 102 o pause: avoid updating socket if done was already called [22] 103 o projects: Fix Visual Studio projects SSH builds [41] 104 o projects: Fix Visual Studio wolfSSL configurations 105 o quiche: reject HTTP/3 headers in the wrong order [17] 106 o remove_handle: clear expire timers after multi_done() [20] 107 o runtests: --repeat=[num] to repeat tests [91] 108 o runtests: introduce --shallow to reduce huge torture tests [70] 109 o schannel: fix --tls-max for when min is --tlsv1 or default [39] 110 o setopt: Fix ALPN / NPN user option when built without HTTP2 [42] 111 o strerror: Add Curl_winapi_strerror for Win API specific errors [51] 112 o strerror: Fix an error looking up some Windows error strings 113 o strerror: Fix compiler warning "empty expression" [79] 114 o system.h: fix for MCST lcc compiler [23] 115 o test/sws: search for "Testno:" header unconditionally if no testno [73] 116 o test1175: verify symbols-in-versions and libcurl-errors.3 in sync [28] 117 o test1270: a basic -w redirect_url test [82] 118 o test1456: remove the use of a fixed local port number [77] 119 o test1558: use double slash after file: [21] 120 o test1560: require IPv6 for IPv6 aware URL parsing [24] 121 o tests/lib1557: fix mem-leak in OOM [66] 122 o tests/lib1559: fix mem-leak in OOM [66] 123 o tests/lib1591: free memory properly on OOM, in the trailers callback [90] 124 o tests/unit1607: fix mem-leak in OOM [66] 125 o tests/unit1609: fix mem-leak in OOM [66] 126 o tests/unit1620: fix bad free in OOM [66] 127 o tests: Change NTLM tests to require SSL [96] 128 o tests: Fix bounce requests with truncated writes [94] 129 o tests: fix build with `CURL_DISABLE_DOH` [64] 130 o tests: fix permissions of ssh keys in WSL [58] 131 o tests: make it possible to set executable extensions [58] 132 o tests: make sure checksrc runs on header files too 133 o tests: set LC_ALL=en_US.UTF-8 instead of blank in several tests [74] 134 o tests: use DoH feature for DoH tests [64] 135 o tests: use \r\n for log messages in WSL [58] 136 o tool_operate: fix mem leak when failed config parse [98] 137 o travis: Fix error detection [97] 138 o travis: abandon coveralls, it is not reliable [57] 139 o travis: build ngtcp2 with --enable-lib-only [32] 140 o travis: export the CC/CXX variables when set [34] 141 o vtls: make BearSSL possible to set with CURL_SSL_BACKEND [72] 142 o winbuild: Define CARES_STATICLIB when WITH_CARES=static [59] 143 o winbuild: Document CURL_STATICLIB requirement for static libcurl [88] 144 145This release includes the following known bugs: 146 147 o see docs/KNOWN_BUGS (https://curl.haxx.se/docs/knownbugs.html) 148 149This release would not have looked like this without help, code, reports and 150advice from friends like these: 151 152 3dyd on github, Anderson Sasaki, Andreas Falkenhahn, Andrew Ishchuk, 153 bdry on github, Bjoern Franke, Brian Carpenter, bxac on github, 154 Bylon2 on github, Christian Schmitz, Christopher Head, Christopher Reid, 155 Christoph M. Becker, Cynthia Coan, Dan Fandrich, Daniel Gustafsson, 156 Daniel Stenberg, David Benjamin, Emil Engler, Fernando Muñoz, Frank Gevaerts, 157 Geeknik Labs, Gergely Nagy, Gisle Vanem, JanB on github, Javier Blazquez, 158 Jeff Mears, Jeffrey Walton, John Schroeder, Kamil Dudka, 159 kouzhudong on github, Kunal Ekawde, Leonardo Taccari, Marc Aldorasi, 160 Marcel Raad, marc-groundctl on github, Marc Hörsken, Maros Priputen, 161 Massimiliano Fantuzzi, Max Kellermann, Melissa Mears, Michael Forney, 162 Michael Vittiglio, Mohammad Hasbini, Niall O'Reilly, Paul Groke, 163 Paul Hoffman, Paul Joyce, Paulo Roberto Tomasi, Pavel Löbl, Pavel Pavlov, 164 Peter Wu, Ram Krushna Mishra, Ray Satiro, Richard Alcock, Richard Bowker, 165 Rickard Hallerbäck, Santino Keupp, sayrer on github, Shailesh Kapse, 166 Simon Warta, SLDiggie on github, Steve Holme, Tatsuhiro Tsujikawa, 167 Tom van der Woerdt, Victor Magierski, Vlastimil Ovčáčík, Wyatt O'Day, 168 Xiang Xiao, Xiaoyin Liu, 169 (70 contributors) 170 171 Thanks! (and sorry if I forgot to mention someone) 172 173References to bug reports and discussions on issues: 174 175 [1] = https://curl.haxx.se/bug/?i=4567 176 [2] = https://curl.haxx.se/bug/?i=4565 177 [3] = https://curl.haxx.se/bug/?i=3704 178 [4] = https://curl.haxx.se/bug/?i=4570 179 [5] = https://curl.haxx.se/bug/?i=4525 180 [6] = https://curl.haxx.se/bug/?i=4604 181 [7] = https://curl.haxx.se/bug/?i=4614 182 [8] = https://curl.haxx.se/bug/?i=4612 183 [9] = https://curl.haxx.se/bug/?i=4609 184 [10] = https://curl.haxx.se/bug/?i=4606 185 [11] = https://curl.haxx.se/bug/?i=4598 186 [12] = https://curl.haxx.se/bug/?i=4600 187 [13] = https://curl.haxx.se/bug/?i=4590 188 [14] = https://curl.haxx.se/bug/?i=4596 189 [15] = https://curl.haxx.se/bug/?i=4594 190 [16] = https://curl.haxx.se/bug/?i=4588 191 [17] = https://curl.haxx.se/bug/?i=4571 192 [18] = https://curl.haxx.se/bug/?i=4585 193 [19] = https://curl.haxx.se/bug/?i=4545 194 [20] = https://curl.haxx.se/bug/?i=4575 195 [21] = https://curl.haxx.se/bug/?i=4554 196 [22] = https://curl.haxx.se/bug/?i=4563 197 [23] = https://curl.haxx.se/bug/?i=4576 198 [24] = https://curl.haxx.se/bug/?i=4556 199 [25] = https://curl.haxx.se/bug/?i=4549 200 [26] = https://curl.haxx.se/bug/?i=4624 201 [27] = https://curl.haxx.se/bug/?i=4593 202 [28] = https://curl.haxx.se/bug/?i=4628 203 [29] = https://curl.haxx.se/bug/?i=4500 204 [30] = https://curl.haxx.se/bug/?i=4618 205 [31] = https://curl.haxx.se/bug/?i=4543 206 [32] = https://curl.haxx.se/bug/?i=4646 207 [33] = https://curl.haxx.se/bug/?i=4645 208 [34] = https://curl.haxx.se/bug/?i=4637 209 [35] = https://curl.haxx.se/bug/?i=2051 210 [36] = https://curl.haxx.se/bug/?i=4599 211 [37] = https://curl.haxx.se/bug/?i=4597 212 [38] = https://curl.haxx.se/bug/?i=4418 213 [39] = https://curl.haxx.se/bug/?i=4633 214 [40] = https://curl.haxx.se/bug/?i=4607 215 [41] = https://curl.haxx.se/bug/?i=4492 216 [42] = https://curl.haxx.se/bug/?i=4668 217 [43] = https://curl.haxx.se/bug/?i=4663 218 [44] = https://curl.haxx.se/bug/?i=4662 219 [45] = https://curl.haxx.se/bug/?i=4665 220 [46] = https://curl.haxx.se/mail/lib-2019-11/0094.html 221 [47] = https://curl.haxx.se/bug/?i=4644 222 [48] = https://curl.haxx.se/mail/lib-2019-12/0007.html 223 [49] = https://curl.haxx.se/bug/?i=4658 224 [50] = https://curl.haxx.se/bug/?i=2425 225 [51] = https://curl.haxx.se/bug/?i=4550 226 [52] = https://curl.haxx.se/bug/?i=4636 227 [53] = https://curl.haxx.se/bug/?i=4152 228 [54] = https://curl.haxx.se/bug/?i=4649 229 [55] = https://curl.haxx.se/bug/?i=3935 230 [56] = https://curl.haxx.se/bug/?i=4301 231 [57] = https://curl.haxx.se/bug/?i=4694 232 [58] = https://curl.haxx.se/bug/?i=3899 233 [59] = https://curl.haxx.se/bug/?i=4688 234 [60] = https://curl.haxx.se/bug/?i=4557 235 [61] = https://curl.haxx.se/bug/?i=4544 236 [62] = https://curl.haxx.se/bug/?i=4680 237 [63] = https://curl.haxx.se/bug/?i=4713 238 [64] = https://curl.haxx.se/bug/?i=4692 239 [65] = https://curl.haxx.se/bug/?i=4710 240 [66] = https://curl.haxx.se/bug/?i=4709 241 [67] = https://curl.haxx.se/bug/?i=4707 242 [68] = https://curl.haxx.se/bug/?i=4704 243 [69] = https://curl.haxx.se/bug/?i=4705 244 [70] = https://curl.haxx.se/bug/?i=4699 245 [71] = https://curl.haxx.se/bug/?i=4369 246 [72] = https://curl.haxx.se/bug/?i=4698 247 [73] = https://curl.haxx.se/bug/?i=4744 248 [74] = https://curl.haxx.se/bug/?i=4738 249 [75] = https://curl.haxx.se/bug/?i=4739 250 [76] = https://curl.haxx.se/bug/?i=4732 251 [77] = https://curl.haxx.se/bug/?i=4733 252 [78] = https://curl.haxx.se/bug/?i=4736 253 [79] = https://github.com/curl/curl/commit/5b22e1a#r36458547 254 [80] = https://curl.haxx.se/bug/?i=4730 255 [81] = https://curl.haxx.se/bug/?i=4731 256 [82] = https://curl.haxx.se/bug/?i=4728 257 [83] = https://curl.haxx.se/bug/?i=4725 258 [84] = https://curl.haxx.se/bug/?i=4683 259 [85] = https://curl.haxx.se/bug/?i=4296 260 [86] = https://curl.haxx.se/bug/?i=4261 261 [87] = https://curl.haxx.se/bug/?i=4262 262 [88] = https://curl.haxx.se/bug/?i=4721 263 [89] = https://curl.haxx.se/bug/?i=4714 264 [90] = https://curl.haxx.se/bug/?i=4720 265 [91] = https://curl.haxx.se/bug/?i=4715 266 [92] = https://curl.haxx.se/bug/?i=4735 267 [93] = https://curl.haxx.se/bug/?i=4775 268 [94] = https://github.com/curl/curl/pull/4717#issuecomment-570240785 269 [95] = https://curl.haxx.se/bug/?i=4771 270 [96] = https://curl.haxx.se/bug/?i=4768 271 [97] = https://curl.haxx.se/bug/?i=3730 272 [98] = https://curl.haxx.se/bug/?i=4767 273 [99] = https://curl.haxx.se/bug/?i=4756 274 [100] = https://curl.haxx.se/bug/?i=4758 275 [101] = https://curl.haxx.se/bug/?i=4751 276 [102] = https://curl.haxx.se/bug/?i=4745 277 [103] = https://curl.haxx.se/bug/?i=4772 278 [104] = https://curl.haxx.se/bug/?i=4781 279 [105] = https://curl.haxx.se/bug/?i=4786 280 [106] = https://curl.haxx.se/docs/CVE-2019-15601.html 281 [107] = https://curl.haxx.se/bug/?i=4787 282 [108] = https://curl.haxx.se/bug/?i=4785 283 [109] = https://curl.haxx.se/bug/?i=4783 284 [110] = https://curl.haxx.se/bug/?i=4790 285 [111] = https://curl.haxx.se/bug/?i=4788 286