_   _ ____  _
                              ___| | | |  _ \| |
                             / __| | | | |_) | |
                            | (__| |_| |  _ <| |___
                             \___|\___/|_| \_\_____|

                                  Changelog




























































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































Version 7.66.0 (10 Sep 2019)

Daniel Stenberg (10 Sep 2019)
- RELEASE-NOTES: curl 7.66.0

- THANKS: from the 7.66.0 release

  
  The problem can be reproduced as follows:
  
   % curl --reso<TAB>
   % curl -E <TAB>
  
  Bug: https://bugs.debian.org/921452

- zsh.pl: update regex to better match curl -h output
  
  The current regex fails to match '<...>' arguments properly (e.g. those
  with spaces in them), which causes an completion script with wrong
  descriptions for some options.
  
  Here's a diff of the generated completion script, comparing the previous
  version to the one with this fix:
  
  --- /usr/share/zsh/vendor-completions/_curl     2019-01-15 20:47:40.000000000 +0000
  +++ _curl       2019-02-05 20:57:29.453349040 +0000
  @@ -9,48 +9,48 @@
  
   _arguments -C -S \
     --happy-eyeballs-timeout-ms'[How long to wait in milliseconds for IPv6 before trying IPv4]':'<milliseconds>' \
  +  --resolve'[Resolve the host+port to this address]':'<host:port:address[,address]...>' \
     {-c,--cookie-jar}'[Write cookies to <filename> after operation]':'<filename>':_files \
     {-D,--dump-header}'[Write the received headers to <filename>]':'<filename>':_files \
     {-y,--speed-time}'[Trigger '\''speed-limit'\'' abort after this time]':'<seconds>' \
     --proxy-cacert'[CA certificate to verify peer against for proxy]':'<file>':_files \
  -  --tls13-ciphers'[of TLS 1.3 ciphersuites> TLS 1.3 cipher suites to use]':'<list' \
  +  --tls13-ciphers'[TLS 1.3 cipher suites to use]':'<list of TLS 1.3 ciphersuites>' \
     {-E,--cert}'[Client certificate file and password]':'<certificate[:password]>' \
     --libcurl'[Dump libcurl equivalent code of this command line]':'<file>':_files \
     --proxy-capath'[CA directory to verify peer against for proxy]':'<dir>':_files \
  -  --proxy-negotiate'[HTTP Negotiate (SPNEGO) authentication on the proxy]':'Use' \
     --proxy-pinnedpubkey'[FILE/HASHES public key to verify proxy with]':'<hashes>' \
     --crlfile'[Get a CRL list in PEM format from the given file]':'<file>':_files \
  -  --proxy-insecure'[HTTPS proxy connections without verifying the proxy]':'Do' \
  -  --proxy-ssl-allow-beast'[security flaw for interop for HTTPS proxy]':'Allow' \
  +  --proxy-negotiate'[Use HTTP Negotiate (SPNEGO) authentication on the proxy]' \
     --abstract-unix-socket'[Connect via abstract Unix domain socket]':'<path>' \
     --pinnedpubkey'[FILE/HASHES Public key to verify peer against]':'<hashes>' \
  +  --proxy-insecure'[Do HTTPS proxy connections without verifying the proxy]' \
     --proxy-pass'[Pass phrase for the private key for HTTPS proxy]':'<phrase>' \
  +  --proxy-ssl-allow-beast'[Allow security flaw for interop for HTTPS proxy]' \
     {-p,--proxytunnel}'[Operate through an HTTP proxy tunnel (using CONNECT)]' \
     --socks5-hostname'[SOCKS5 proxy, pass host name to proxy]':'<host[:port]>' \
     --proto-default'[Use PROTOCOL for any URL missing a scheme]':'<protocol>' \
  -  --proxy-tls13-ciphers'[list> TLS 1.3 proxy cipher suites]':'<ciphersuite' \
  +  --proxy-tls13-ciphers'[TLS 1.3 proxy cipher suites]':'<ciphersuite list>' \
     --socks5-gssapi-service'[SOCKS5 proxy service name for GSS-API]':'<name>' \
     --ftp-alternative-to-user'[String to replace USER \[name\]]':'<command>' \
  -  --ftp-ssl-control'[SSL/TLS for FTP login, clear for transfer]':'Require' \
     {-T,--upload-file}'[Transfer local FILE to destination]':'<file>':_files \
     --local-port'[Force use of RANGE for local port numbers]':'<num/range>' \
     --proxy-tlsauthtype'[TLS authentication type for HTTPS proxy]':'<type>' \
     {-R,--remote-time}'[Set the remote file'\''s time on the local output]' \
  -  --retry-connrefused'[on connection refused (use with --retry)]':'Retry' \
  -  --suppress-connect-headers'[proxy CONNECT response headers]':'Suppress' \
  -  {-j,--junk-session-cookies}'[session cookies read from file]':'Ignore' \
  -  --location-trusted'[--location, and send auth to other hosts]':'Like' \
  +  --ftp-ssl-control'[Require SSL/TLS for FTP login, clear for transfer]' \
     --proxy-cert-type'[Client certificate type for HTTPS proxy]':'<type>' \
     {-O,--remote-name}'[Write output to a file named as the remote file]' \
  +  --retry-connrefused'[Retry on connection refused (use with --retry)]' \
  +  --suppress-connect-headers'[Suppress proxy CONNECT response headers]' \
     --trace-ascii'[Like --trace, but without hex output]':'<file>':_files \
     --connect-timeout'[Maximum time allowed for connection]':'<seconds>' \
     --expect100-timeout'[How long to wait for 100-continue]':'<seconds>' \
     {-g,--globoff}'[Disable URL sequences and ranges using {} and \[\]]' \
  +  {-j,--junk-session-cookies}'[Ignore session cookies read from file]' \
     {-m,--max-time}'[Maximum time allowed for the transfer]':'<seconds>' \
     --dns-ipv4-addr'[IPv4 address to use for DNS requests]':'<address>' \
     --dns-ipv6-addr'[IPv6 address to use for DNS requests]':'<address>' \
  -  --ignore-content-length'[the size of the remote resource]':'Ignore' \
     {-k,--insecure}'[Allow insecure server connections when using SSL]' \
  +  --location-trusted'[Like --location, and send auth to other hosts]' \
     --mail-auth'[Originator address of the original email]':'<address>' \
     --noproxy'[List of hosts which do not use proxy]':'<no-proxy-list>' \
     --proto-redir'[Enable/disable PROTOCOLS on redirect]':'<protocols>' \
  @@ -62,18 +62,19 @@
     --socks5-basic'[Enable username/password auth for SOCKS5 proxies]' \
     --cacert'[CA certificate to verify peer against]':'<file>':_files \
     {-H,--header}'[Pass custom header(s) to server]':'<header/@file>' \
  +  --ignore-content-length'[Ignore the size of the remote resource]' \
     {-i,--include}'[Include protocol response headers in the output]' \
     --proxy-header'[Pass custom header(s) to proxy]':'<header/@file>' \
     --unix-socket'[Connect through this Unix domain socket]':'<path>' \
     {-w,--write-out}'[Use output FORMAT after completion]':'<format>' \
  -  --http2-prior-knowledge'[HTTP 2 without HTTP/1.1 Upgrade]':'Use' \
     {-o,--output}'[Write to file instead of stdout]':'<file>':_files \
  -  {-J,--remote-header-name}'[the header-provided filename]':'Use' \
  +  --preproxy'[\[protocol://\]host\[:port\] Use this proxy first]' \
     --socks4a'[SOCKS4a proxy on given host + port]':'<host[:port]>' \
     {-Y,--speed-limit}'[Stop transfers slower than this]':'<speed>' \
     {-z,--time-cond}'[Transfer based on a time condition]':'<time>' \
     --capath'[CA directory to verify peer against]':'<dir>':_files \
     {-f,--fail}'[Fail silently (no output at all) on HTTP errors]' \
  +  --http2-prior-knowledge'[Use HTTP 2 without HTTP/1.1 Upgrade]' \
     --proxy-tlspassword'[TLS password for HTTPS proxy]':'<string>' \
     {-U,--proxy-user}'[Proxy user and password]':'<user:password>' \
     --proxy1.0'[Use HTTP/1.0 proxy on given port]':'<host[:port]>' \
  @@ -81,52 +82,49 @@
     {-A,--user-agent}'[Send User-Agent <name> to server]':'<name>' \
     --egd-file'[EGD socket path for random data]':'<file>':_files \
     --fail-early'[Fail on first transfer error, do not continue]' \
  -  --haproxy-protocol'[HAProxy PROXY protocol v1 header]':'Send' \
  -  --preproxy'[Use this proxy first]':'[protocol://]host[:port]' \
  +  {-J,--remote-header-name}'[Use the header-provided filename]' \
     --retry-max-time'[Retry only within this period]':'<seconds>' \
     --socks4'[SOCKS4 proxy on given host + port]':'<host[:port]>' \
     --socks5'[SOCKS5 proxy on given host + port]':'<host[:port]>' \
  -  --socks5-gssapi-nec'[with NEC SOCKS5 server]':'Compatibility' \
  -  --ssl-allow-beast'[security flaw to improve interop]':'Allow' \
     --cert-status'[Verify the status of the server certificate]' \
  -  --ftp-create-dirs'[the remote dirs if not present]':'Create' \
     {-:,--next}'[Make next URL use its separate set of options]' \
     --proxy-key-type'[Private key file type for proxy]':'<type>' \
  -  --remote-name-all'[the remote file name for all URLs]':'Use' \
     {-X,--request}'[Specify request command to use]':'<command>' \
     --retry'[Retry request if transient problems occur]':'<num>' \
  -  --ssl-no-revoke'[cert revocation checks (WinSSL)]':'Disable' \
     --cert-type'[Certificate file type (DER/PEM/ENG)]':'<type>' \
     --connect-to'[Connect to host]':'<HOST1:PORT1:HOST2:PORT2>' \
     --create-dirs'[Create necessary local directory hierarchy]' \
  +  --haproxy-protocol'[Send HAProxy PROXY protocol v1 header]' \
     --max-redirs'[Maximum number of redirects allowed]':'<num>' \
     {-n,--netrc}'[Must read .netrc for user name and password]' \
  +  {-x,--proxy}'[\[protocol://\]host\[:port\] Use this proxy]' \
     --proxy-crlfile'[Set a CRL list for proxy]':'<file>':_files \
     --sasl-ir'[Enable initial response in SASL authentication]' \
  -  --socks5-gssapi'[GSS-API auth for SOCKS5 proxies]':'Enable' \
  +  --socks5-gssapi-nec'[Compatibility with NEC SOCKS5 server]' \
  +  --ssl-allow-beast'[Allow security flaw to improve interop]' \
  +  --ftp-create-dirs'[Create the remote dirs if not present]' \
     --interface'[Use network INTERFACE (or address)]':'<name>' \
     --key-type'[Private key file type (DER/PEM/ENG)]':'<type>' \
     --netrc-file'[Specify FILE for netrc]':'<filename>':_files \
     {-N,--no-buffer}'[Disable buffering of the output stream]' \
     --proxy-service-name'[SPNEGO proxy service name]':'<name>' \
  -  --styled-output'[styled output for HTTP headers]':'Enable' \
  +  --remote-name-all'[Use the remote file name for all URLs]' \
  +  --ssl-no-revoke'[Disable cert revocation checks (WinSSL)]' \
     --max-filesize'[Maximum file size to download]':'<bytes>' \
     --negotiate'[Use HTTP Negotiate (SPNEGO) authentication]' \
     --no-keepalive'[Disable TCP keepalive on the connection]' \
     {-#,--progress-bar}'[Display transfer progress as a bar]' \
  -  {-x,--proxy}'[Use this proxy]':'[protocol://]host[:port]' \
  -  --proxy-anyauth'[any proxy authentication method]':'Pick' \
     {-Q,--quote}'[Send command(s) to server before transfer]' \
  -  --request-target'[the target for this request]':'Specify' \
  +  --socks5-gssapi'[Enable GSS-API auth for SOCKS5 proxies]' \
     {-u,--user}'[Server user and password]':'<user:password>' \
     {-K,--config}'[Read config from a file]':'<file>':_files \
     {-C,--continue-at}'[Resumed transfer offset]':'<offset>' \
     --data-raw'[HTTP POST data, '\''@'\'' allowed]':'<data>' \
  -  --disallow-username-in-url'[username in url]':'Disallow' \
     --krb'[Enable Kerberos with security <level>]':'<level>' \
     --proxy-ciphers'[SSL ciphers to use for proxy]':'<list>' \
     --proxy-digest'[Use Digest authentication on the proxy]' \
     --proxy-tlsuser'[TLS username for HTTPS proxy]':'<name>' \
  +  --styled-output'[Enable styled output for HTTP headers]' \
     {-b,--cookie}'[Send cookies from string/file]':'<data>' \
     --data-urlencode'[HTTP POST data url encoded]':'<data>' \
     --delegation'[GSS-API delegation permission]':'<LEVEL>' \
  @@ -134,7 +132,10 @@
     --post301'[Do not switch to GET after following a 301]' \
     --post302'[Do not switch to GET after following a 302]' \
     --post303'[Do not switch to GET after following a 303]' \
  +  --proxy-anyauth'[Pick any proxy authentication method]' \
  +  --request-target'[Specify the target for this request]' \
     --trace-time'[Add time stamps to trace/verbose output]' \
  +  --disallow-username-in-url'[Disallow username in url]' \
     --dns-servers'[DNS server addrs to use]':'<addresses>' \
     {-G,--get}'[Put the post data in the URL and use GET]' \
     --limit-rate'[Limit transfer speed to RATE]':'<speed>' \
  @@ -148,21 +149,21 @@
     --metalink'[Process given URLs as metalink XML file]' \
     --tr-encoding'[Request compressed transfer encoding]' \
     --xattr'[Store metadata in extended file attributes]' \
  -  --ftp-skip-pasv-ip'[the IP address for PASV]':'Skip' \
     --pass'[Pass phrase for the private key]':'<phrase>' \
     --proxy-ntlm'[Use NTLM authentication on the proxy]' \
     {-S,--show-error}'[Show error even when -s is used]' \
  -  --ciphers'[of ciphers> SSL ciphers to use]':'<list' \
  +  --ciphers'[SSL ciphers to use]':'<list of ciphers>' \
     --form-string'[Specify multipart MIME data]':'<name=string>' \
     --login-options'[Server login options]':'<options>' \
     --tftp-blksize'[Set TFTP BLKSIZE option]':'<value>' \
  -  --tftp-no-options'[not send any TFTP options]':'Do' \
     {-v,--verbose}'[Make the operation more talkative]' \
  +  --ftp-skip-pasv-ip'[Skip the IP address for PASV]' \
     --proxy-key'[Private key for HTTPS proxy]':'<key>' \
     {-F,--form}'[Specify multipart MIME data]':'<name=content>' \
     --mail-from'[Mail from this address]':'<address>' \
     --oauth2-bearer'[OAuth 2 Bearer Token]':'<token>' \
     --proto'[Enable/disable PROTOCOLS]':'<protocols>' \
  +  --tftp-no-options'[Do not send any TFTP options]' \
     --tlsauthtype'[TLS authentication type]':'<type>' \
     --doh-url'[Resolve host names over DOH]':'<URL>' \
     --no-sessionid'[Disable SSL session-ID reusing]' \
  @@ -173,14 +174,13 @@
     --ftp-ssl-ccc'[Send CCC after authenticating]' \
     {-4,--ipv4}'[Resolve names to IPv4 addresses]' \
     {-6,--ipv6}'[Resolve names to IPv6 addresses]' \
  -  --netrc-optional'[either .netrc or URL]':'Use' \
     --service-name'[SPNEGO service name]':'<name>' \
     {-V,--version}'[Show version number and quit]' \
     --data-ascii'[HTTP POST ASCII data]':'<data>' \
     --ftp-account'[Account data string]':'<data>' \
  -  --compressed-ssh'[SSH compression]':'Enable' \
     --disable-eprt'[Inhibit using EPRT or LPRT]' \
     --ftp-method'[Control CWD usage]':'<method>' \
  +  --netrc-optional'[Use either .netrc or URL]' \
     --pubkey'[SSH Public key file name]':'<key>' \
     --raw'[Do HTTP "raw"; no transfer decoding]' \
     --anyauth'[Pick any authentication method]' \
  @@ -189,6 +189,7 @@
     --no-alpn'[Disable the ALPN TLS extension]' \
     --tcp-nodelay'[Use the TCP_NODELAY option]' \
     {-B,--use-ascii}'[Use ASCII/text transfer]' \
  +  --compressed-ssh'[Enable SSH compression]' \
     --digest'[Use HTTP Digest Authentication]' \
     --proxy-tlsv1'[Use TLSv1 for HTTPS proxy]' \
     --engine'[Crypto engine to use]':'<name>' \

Marcel Raad (7 Feb 2019)
- tool_operate: fix typecheck warning
  
  Use long for CURLOPT_HTTP09_ALLOWED to fix the following warning:
  tool_operate.c: In function 'operate_do':
  ../include/curl/typecheck-gcc.h:47:9: error: call to
  '_curl_easy_setopt_err_long' declared with attribute warning:
  curl_easy_setopt expects a long argument for this option [-Werror]
  
  Closes https://github.com/curl/curl/pull/3534

Jay Satiro (6 Feb 2019)
- [Chris Araman brought this change]

  url: close TLS before removing conn from cache
  
  - Fix potential crashes in schannel shutdown.
  
  Ensure any TLS shutdown messages are sent before removing the
  association between the connection and the easy handle. Reverts
  @bagder's previous partial fix for #3412.
  
  Fixes https://github.com/curl/curl/issues/3412
  Fixes https://github.com/curl/curl/issues/3505
  Closes https://github.com/curl/curl/pull/3531

Daniel Gustafsson (6 Feb 2019)
- INTERNALS.md: fix subsection depth and link
  
  The Kerberos subsection was mistakenly a subsubsection under FTP, and
  the curlx subsection was missing an anchor for the TOC link.
  
  Closes #3529
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Version 7.64.0 (6 Feb 2019)

Daniel Stenberg (6 Feb 2019)
- RELEASE-NOTES: 7.64.0

- RELEASE-PROCEDURE: update the release calendar

- THANKS: 7.64.0 status

Daniel Gustafsson (5 Feb 2019)
- ROADMAP: remove already performed item
  
  Commit 7a09b52c98ac8d840a8a9907b1a1d9a9e684bcf5 introduced support
  for the draft-ietf-httpbis-cookie-alone-01 cookie draft, and while
  the entry was removed from the TODO it was mistakenly left here.
  Fix by removing and rewording the entry slightly.
  
  Closes #3530
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

- [Etienne Simard brought this change]

  CONTRIBUTE.md: Fix grammatical errors
  
  Fix grammatical errors making the document read better. Also fixes
  a typo.
  
  Closes #3525
  Reviewed-by: Daniel Gustafsson <daniel@yesql.se>

Daniel Stenberg (4 Feb 2019)
- [Julian Z brought this change]

  docs: use $(INSTALL_DATA) to install man page
  
  Fixes #3518
  Closes #3522

Jay Satiro (4 Feb 2019)
- [Ladar Levison brought this change]

  runtests.pl: Fix perl call to include srcdir
  
  - Use explicit include opt for perl calls.
  
  Prior to this change some scripts couldn't find their dependencies.
  
  At the top, perl is called using with the "-Isrcdir" option, and it
  works:
  
  https://github.com/curl/curl/blob/curl-7_63_0/tests/runtests.pl#L183
  
  But on line 3868, that option is omitted. This caused problems for me,
  as the symbol-scan.pl script in particular couldn't find its
  dependencies properly:
  
  https://github.com/curl/curl/blob/curl-7_63_0/tests/runtests.pl#L3868
  
  This patch fixes that oversight by making calls to perl sub-shells
  uniform.
  
  Closes https://github.com/curl/curl/pull/3496

Daniel Stenberg (4 Feb 2019)
- [Daniel Gustafsson brought this change]

  smtp: avoid risk of buffer overflow in strtol
  
  If the incoming len 5, but the buffer does not have a termination
  after 5 bytes, the strtol() call may keep reading through the line
  buffer until is exceeds its boundary. Fix by ensuring that we are
  using a bounded read with a temporary buffer on the stack.
  
  Bug: https://curl.haxx.se/docs/CVE-2019-3823.html
  Reported-by: Brian Carpenter (Geeknik Labs)
  CVE-2019-3823

- ntlm: fix *_type3_message size check to avoid buffer overflow
  
  Bug: https://curl.haxx.se/docs/CVE-2019-3822.html
  Reported-by: Wenxiang Qian
  CVE-2019-3822

- NTLM: fix size check condition for type2 received data
  
  Bug: https://curl.haxx.se/docs/CVE-2018-16890.html
  Reported-by: Wenxiang Qian
  CVE-2018-16890

Marcel Raad (1 Feb 2019)
- [Giorgos Oikonomou brought this change]

  spnego_sspi: add support for channel binding
  
  Attempt to add support for Secure Channel binding when negotiate
  authentication is used. The problem to solve is that by default IIS
  accepts channel binding and curl doesn't utilise them. The result was a
  401 response. Scope affects only the Schannel(winssl)-SSPI combination.
  
  Fixes https://github.com/curl/curl/issues/3503
  Closes https://github.com/curl/curl/pull/3509

Daniel Stenberg (1 Feb 2019)
- RELEASE-NOTES: synced

- schannel: stop calling it "winssl"
  
  Stick to "Schannel" everywhere. The configure option --with-winssl is
  kept to allow existing builds to work but --with-schannel is added as an
  alias.
  
  Closes #3504

- multi: set the EXPIRE_*TIMEOUT timers at TIMER_STARTSINGLE time
  
  To make sure Curl_timeleft() also thinks the timeout has been reached
  when one of the EXPIRE_*TIMEOUTs expires.
  
  Bug: https://curl.haxx.se/mail/lib-2019-01/0073.html
  Reported-by: Zhao Yisha
  Closes #3501

- [John Marshall brought this change]

  doc: use meaningless port number in CURLOPT_LOCALPORT example
  
  Use an ephemeral port number here; previously the example had 8080
  which could be confusing as the common web server port number might
  be misinterpreted as suggesting this option affects the remote port.
  
  URL: https://curl.haxx.se/mail/lib-2019-01/0084.html
  Closes #3513

GitHub (29 Jan 2019)
- [Gisle Vanem brought this change]

  Escape the '\'
  
  A backslash should be escaped in Roff / Troff.

Jay Satiro (29 Jan 2019)
- TODO: WinSSL: 'Add option to disable client cert auto-send'
  
  By default WinSSL selects and send a client certificate automatically,
  but for privacy and consistency we should offer an option to disable the
  default auto-send behavior.
  
  Reported-by: Jeroen Ooms
  
  Closes https://github.com/curl/curl/issues/2262

Daniel Stenberg (28 Jan 2019)
- [Jeremie Rapin brought this change]

  sigpipe: if mbedTLS is used, ignore SIGPIPE
  
  mbedTLS doesn't have a sigpipe management. If a write/read occurs when
  the remote closes the socket, the signal is raised and kills the
  application.  Use the curl mecanisms fix this behavior.
  
  Signed-off-by: Jeremie Rapin <j.rapin@overkiz.com>
  
  Closes #3502

- unit1653: make it survive torture tests

Jay Satiro (28 Jan 2019)
- [Michael Kujawa brought this change]

  timeval: Disable MSVC Analyzer GetTickCount warning
  
  Compiling with msvc /analyze and a recent Windows SDK warns against
  using GetTickCount (Suggests to use GetTickCount64 instead.)
  
  Since GetTickCount is only being used when GetTickCount64 isn't
  available, I am disabling that warning.
  
  Fixes https://github.com/curl/curl/issues/3437
  Closes https://github.com/curl/curl/pull/3440

Daniel Stenberg (26 Jan 2019)
- configure: rewrite --enable-code-coverage
  
  The previously used ax_code_coverage.m4 is not license compatible and
  must not be used.
  
  Reported-by: William A. Rowe Jr
  Fixes #3497
  Closes #3499

- [Felix Hädicke brought this change]

  setopt: enable CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION for libssh
  
  CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION are supported for
  libssh as well. So accepting these options only when compiling with
  libssh2 is wrong here.
  
  Fixes #3493
  Closes #3494

- [Felix Hädicke brought this change]

  libssh: do not let libssh create socket
  
  By default, libssh creates a new socket, instead of using the socket
  created by curl for SSH connections.
  
  Pass the socket created by curl to libssh using ssh_options_set() with
  SSH_OPTIONS_FD directly after ssh_new(). So libssh uses our socket
  instead of creating a new one.
  
  This approach is very similar to what is done in the libssh2 code, where
  the socket created by curl is passed to libssh2 when
  libssh2_session_startup() is called.
  
  Fixes #3491
  Closes #3495

- RELEASE-NOTES: synced

- [Archangel_SDY brought this change]

  schannel: preserve original certificate path parameter
  
  Fixes #3480
  Closes #3487

- KNOWN_BUGS: tests not compatible with python3
  
  Closes #3289
  [skip ci]

Daniel Gustafsson (20 Jan 2019)
- memcmp: avoid doing single char memcmp
  
  There is no real gain in performing memcmp() comparisons on single
  characters, so change these to array subscript inspections which
  saves a call and makes the code clearer.
  
  Closes #3486
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>
  Reviewed-by: Jay Satiro <raysatiro@yahoo.com>

Daniel Stenberg (19 Jan 2019)
- COPYING: it's 2019
  
  [skip ci]

- [hhb brought this change]

  configure: fix recv/send/select detection on Android
  
  This reverts commit d4f25201fb7da03fc88f90d51101beb3d0026db9.
  
  The overloadable attribute is removed again starting from
  NDK17. Actually they only exist in two NDK versions (15 and 16). With
  overloadable, the first condition tried will succeed. Results in wrong
  detection result.
  
  Closes #3484

Marcel Raad (19 Jan 2019)
- [Giorgos Oikonomou brought this change]

  ntlm_sspi: add support for channel binding
  
  Windows extended potection (aka ssl channel binding) is required
  to login to ntlm IIS endpoint, otherwise the server returns 401
  responses.
  
  Fixes #3280
  Closes #3321

Daniel Stenberg (18 Jan 2019)
- schannel: on connection close there might not be a transfer
  
  Reported-by: Marcel Raad
  Fixes #3412
  Closes #3483

- [Joel Depooter brought this change]

  ssh: log the libssh2 error message when ssh session startup fails
  
  When a ssh session startup fails, it is useful to know why it has
  failed. This commit changes the message from:
     "Failure establishing ssh session"
  to something like this, for example:
     "Failure establishing ssh session: -5, Unable to exchange encryption keys"
  
  Closes #3481

Alessandro Ghedini (16 Jan 2019)
- Fix typo in manpage

Daniel Stenberg (16 Jan 2019)
- RELEASE-NOTES: synced

Sergei Nikulov (16 Jan 2019)
- cmake: updated check for HAVE_POLL_FINE to match autotools

Daniel Stenberg (16 Jan 2019)
- curl-compilers.m4: check for __ibmxl__ to detect xlclang
  
  Follow-up to 2fa0d57e2e3. The __xlc__ symbol is only defined there if a
  particular flag is used for legacy macros.
  
  Fixes #3474
  Closes #3479

- openssl: fix the SSL_get_tlsext_status_ocsp_resp call
  
  .... to not pass in a const in the second argument as that's not how it
  is supposed to be used and might cause compiler warnings.
  
  Reported-by: Pavel Pavlov
  Fixes #3477
  Closes #3478

- curl-compilers.m4: detect xlclang
  
  Since it isn't totally clang compatible, we detect this IBM clang
  front-end and if detected, avoids some clang specific magic.
  
  Reported-by: Kees Dekker
  Fixes #3474
  Closes #3476

- README: add codacy code quality badge
  
  [skip ci]

- extract_if_dead: follow-up to 54b201b48c90a
  
  extract_if_dead() dead is called from two functions, and only one of
  them should get conn->data updated and now neither call path clears it.
  
  scan-build found a case where conn->data would be NULL dereferenced in
  ConnectionExists() otherwise.
  
  Closes #3473

- multi: remove "Dead assignment"
  
  Found by scan-build. Follow-up to 4c35574bb785ce.
  
  Closes #3471

- tests: move objnames-* from lib into tests
  
  Since they're used purely for testing purposes, I think they should
  rather be stored there.
  
  Closes #3470

Sergei Nikulov (15 Jan 2019)
- travis: added cmake build for osx

Daniel Stenberg (14 Jan 2019)
- [Frank Gevaerts brought this change]

  cookie: fix comment typo (url_path_len -> uri_path_len)
  
  Closes #3469

Marcel Raad (14 Jan 2019)
- winbuild: conditionally use /DZLIB_WINAPI
  
  zlibwapi.lib (dynamic library) and zlibstat.lib (static library) have
  the ZLIB_WINAPI define set by default. Using them requires that define
  too.
  
  Ref: https://zlib.net/DLL_FAQ.txt
  
  Fixes https://github.com/curl/curl/issues/3133
  Closes https://github.com/curl/curl/pull/3460

Daniel Stenberg (14 Jan 2019)
- src/Makefile: make 'tidy' target work for metalink builds

- extract_if_dead: use a known working transfer when checking connections
  
  Make sure that this function sets a proper "live" transfer for the
  connection before calling the protocol-specific connection check
  function, and then clear it again afterward as a non-used connection has
  no current transfer.
  
  Reported-by: Jeroen Ooms
  Reviewed-by: Marcel Raad
  Reviewed-by: Daniel Gustafsson
  Fixes #3463
  Closes #3464

- openssl: adapt to 3.0.0, OpenSSL_version_num() is deprecated
  
  OpenSSL_version() replaces OpenSSL_version_num()
  
  Closes #3462

Sergei Nikulov (11 Jan 2019)
- cmake: added checks for HAVE_VARIADIC_MACROS_C99 and HAVE_VARIADIC_MACROS_GCC

Daniel Stenberg (11 Jan 2019)
- urldata: rename easy_conn to just conn
  
  We use "conn" everywhere to be a pointer to the connection.
  
  Introduces two functions that "attaches" and "detaches" the connection
  to and from the transfer.
  
  Going forward, we should favour using "data->conn" (since a transfer
  always only has a single connection or none at all) to "conn->data"
  (since a connection can have none, one or many transfers associated with
  it and updating conn->data to be correct is error prone and a frequent
  reason for internal issues).
  
  Closes #3442

- tool_cb_prg: avoid integer overflow
  
  When calculating the progress bar width.
  
  Reported-by: Peng Li
  Fixes #3456
  Closes #3458

Daniel Gustafsson (11 Jan 2019)
- travis: turn off copyright year checks in checksrc
  
  Invoking the maintainer intended COPYRIGHTYEAR check for everyone
  in the PR pipeline is too invasive, especially at the turn of the
  year when many files get affected. Remove and leave it as a tool
  for maintainers to verify patches before commits.
  
  This reverts f7bdf4b2e1d81b2652b81b9b3029927589273b41.
  
  After discussion with: Daniel Stenberg

Daniel Stenberg (10 Jan 2019)
- KNOWN_BUGS: cmake makes unusable tool_hugehelp.c with MinGW
  
  Closes #3125

- KNOWN_BUGS: Improve --data-urlencode space encoding
  
  Closes #3229

Patrick Monnerat (10 Jan 2019)
- os400: add a missing closing bracket
  
  See https://github.com/curl/curl/issues/3453#issuecomment-453054458
  
  Reported-by: jonrumsey on github

- os400: fix extra parameter syntax error.
  
  Reported-by: jonrumsey on github
  Closes #3453

Daniel Stenberg (10 Jan 2019)
- test1558: verify CURLINFO_PROTOCOL on file:// transfer
  
  Attempt to reproduce issue #3444.
  
  Closes #3447

- RELEASE-NOTES: synced

- xattr: strip credentials from any URL that is stored
  
  Both user and password are cleared uncondtitionally.
  
  Added unit test 1621 to verify.
  
  Fixes #3423
  Closes #3433

- cookies: allow secure override when done over HTTPS
  
  Added test 1562 to verify.
  
  Reported-by: Jeroen Ooms
  Fixes #3445
  Closes #3450

- multi: multiplexing improvements
  
  Fixes #3436
  Closes #3448
  
   Problem 1
  
  After LOTS of scratching my head, I eventually realized that even when doing
  10 uploads in parallel, sometimes the socket callback to the application that
  tells it what to wait for on the socket, looked like it would reflect the
  status of just the single transfer that just changed state.
  
  Digging into the code revealed that this was indeed the truth. When multiple
  transfers are using the same connection, the application did not correctly get
  the *combined* flags for all transfers which then could make it switch to READ
  (only) when in fact most transfers wanted to get told when the socket was
  WRITEABLE.
  
   Problem 1b
  
  A separate but related regression had also been introduced by me when I
  cleared connection/transfer association better a while ago, as now the logic
  couldn't find the connection and see if that was marked as used by more
  transfers and then it would also prematurely remove the socket from the socket
  hash table even in times other transfers were still using it!
  
   Fix 1
  
  Make sure that each socket stored in the socket hash has a "combined" action
  field of what to ask the application to wait for, that is potentially the ORed
  action of multiple parallel transfers. And remove that socket hash entry only
  if there are no transfers left using it.
  
   Problem 2
  
  The socket hash entry stored an association to a single transfer using that
  socket - and when curl_multi_socket_action() was called to tell libcurl about
  activities on that specific socket only that transfer was "handled".
  
  This was WRONG, as a single socket/connection can be used by numerous parallel
  transfers and not necessarily a single one.
  
   Fix 2
  
  We now store a list of handles in the socket hashtable entry and when libcurl
  is told there's traffic for a particular socket, it now iterates over all
  known transfers using that single socket.

- test1561: improve test name
  
  [skip ci]

- [Katsuhiko YOSHIDA brought this change]

  cookies: skip custom cookies when redirecting cross-site
  
  Closes #3417

- THANKS: fixups and a dedupe
  
  [skip ci]

- timediff: fix math for unsigned time_t
  
  Bug: https://curl.haxx.se/mail/lib-2018-12/0088.html
  
  Closes #3449

- [Bernhard M. Wiedemann brought this change]

  tests: allow tests to pass by 2037-02-12
  
  similar to commit f508d29f3902104018
  
  Closes #3443

- RELEASE-NOTES: synced

- [Brad Spencer brought this change]

  curl_multi_remove_handle() don't block terminating c-ares requests
  
  Added Curl_resolver_kill() for all three resolver modes, which only
  blocks when necessary, along with test 1592 to confirm
  curl_multi_remove_handle() doesn't block unless it must.
  
  Closes #3428
  Fixes #3371

- Revert "http_negotiate: do not close connection until negotiation is completed"
  
  This reverts commit 07ebaf837843124ee670e5b8c218b80b92e06e47.
  
  This also reopens PR #3275 which brought the change now reverted.
  
  Fixes #3384
  Closes #3439

- curl/urlapi.h: include "curl.h" first
  
  This allows programs to include curl/urlapi.h directly.
  
  Reviewed-by: Daniel Gustafsson
  Reported-by: Ben Kohler
  Fixes #3438
  Closes #3441

Marcel Raad (6 Jan 2019)
- VS projects: fix build warning
  
  Starting with Visual Studio 2017 Update 9, Visual Studio doesn't like
  the MinimalRebuild option anymore and warns:
  
  cl : Command line warning D9035: option 'Gm' has been deprecated and
  will be removed in a future release
  
  The option can be safely removed so that the default is used.
  
  Closes https://github.com/curl/curl/pull/3425

- schannel: fix compiler warning
  
  When building with Unicode on MSVC, the compiler warns about freeing a
  pointer to const in Curl_unicodefree. Fix this by declaring it as
  non-const and casting the argument to Curl_convert_UTF8_to_tchar to
  non-const too, like we do in all other places.
  
  Closes https://github.com/curl/curl/pull/3435

Daniel Stenberg (4 Jan 2019)
- [Rikard Falkeborn brought this change]

  printf: introduce CURL_FORMAT_TIMEDIFF_T

- [Rikard Falkeborn brought this change]

  printf: fix format specifiers
  
  Closes #3426

- libtest/stub_gssapi: use "real" snprintf
  
  ... since it doesn't link with libcurl.
  
  Reverts the commit dcd6f81025 changes from this file.
  
  Bug: https://curl.haxx.se/mail/lib-2019-01/0000.html
  Reported-by: Shlomi Fish
  Reviewed-by: Daniel Gustafsson
  Reviewed-by: Kamil Dudka
  
  Closes #3434

- INTERNALS: correct some outdated function names
  
  Closes #3431

- docs/version.d: mention MultiSSL
  
  Reviewed-by: Daniel Gustafsson
  Closes #3432

Daniel Gustafsson (2 Jan 2019)
- [Rikard Falkeborn brought this change]

  examples: Update .gitignore
  
  Add a few missing examples to make `make examples` not leave the
  workspace in a dirty state.
  
  Closes #3427
  Reviewed-by: Daniel Gustafsson <daniel@yesql.se>

- THANKS: add more missing names
  
  Add Adrian Burcea who made the artwork for the curl://up 2018 event
  which was held in Stockholm, Sweden.

- docs: mention potential leak in curl_slist_append
  
  When a non-empty list is appended to, and used as the returnvalue,
  the list pointer can leak in case of an allocation failure in the
  curl_slist_append() call. This is correctly handled in curl code
  usage but we weren't explicitly pointing it out in the API call
  documentation. Fix by extending the RETURNVALUE manpage section
  and example code.
  
  Closes #3424
  Reported-by: dnivras on github
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Marcel Raad (1 Jan 2019)
- tvnow: silence conversion warnings
  
  MinGW-w64 defaults to targeting Windows 7 now, so GetTickCount64 is
  used and the milliseconds are represented as unsigned long long,
  leading to a compiler warning when implicitly converting them to long.

Daniel Stenberg (1 Jan 2019)
- THANKS: dedupe more names
  
  Researched-by: Tae Wong

Marcel Raad (1 Jan 2019)
- [Markus Moeller brought this change]

  ntlm: update selection of type 3 response
  
  NTLM2 did not work i.e. no NTLMv2 response was created. Changing the
  check seems to work.
  
  Ref: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-NLMP/[MS-NLMP].pdf
  
  Fixes https://github.com/curl/curl/issues/3286
  Closes https://github.com/curl/curl/pull/3287
  Closes https://github.com/curl/curl/pull/3415

Daniel Stenberg (31 Dec 2018)
- THANKS: added missing names from year <= 2000
  
  Due to a report of a missing name in THANKS I manually went through an
  old CHANGES.0 file and added many previously missing names here.

Daniel Gustafsson (30 Dec 2018)
- urlapi: fix parsing ipv6 with zone index
  
  The previous fix for parsing IPv6 URLs with a zone index was a paddle
  short for URLs without an explicit port. This patch fixes that case
  and adds a unit test case.
  
  This bug was highlighted by issue #3408, and while it's not the full
  fix for the problem there it is an isolated bug that should be fixed
  regardless.
  
  Closes #3411
  Reported-by: GitYuanQu on github
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Daniel Stenberg (30 Dec 2018)
- THANKS: dedupe Guenter Knauf
  
  Reported-by: Tae Wong

- THANKS: missing name from the 6.3.1 release!

Daniel Gustafsson (27 Dec 2018)
- RELEASE-NOTES: synced

- [Claes Jakobsson brought this change]

  hostip: support wildcard hosts
  
  This adds support for wildcard hosts in CURLOPT_RESOLVE. These are
  try-last so any non-wildcard entry is resolved first. If specified,
  any host not matched by another CURLOPT_RESOLVE config will use this
  as fallback.
  
  Example send a.com to 10.0.0.1 and everything else to 10.0.0.2:
    curl --resolve *:443:10.0.0.2 --resolve a.com:443:10.0.0.1 \
         https://a.com https://b.com
  
  This is probably quite similar to using:
    --connect-to a.com:443:10.0.0.1:443 --connect-to :443:10.0.0.2:443
  
  Closes #3406
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

- url: fix incorrect indentation

Patrick Monnerat (26 Dec 2018)
- os400: upgrade ILE/RPG binding.
  
  - Trailer function support.
  - http 0.9 option.
  - curl_easy_upkeep.

Daniel Gustafsson (25 Dec 2018)
- FAQ: remove mention of sourceforge for github
  
  The project bug tracker is no longer hosted at sourceforge but is now
  hosted on the curl Github page. Update the FAQ to reflect.
  
  Closes #3410
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

- openvms: fix typos in documentation

- openvms: fix OpenSSL discovery on VAX
  
  The DCL code had a typo in one of the commands which would make the
  OpenSSL discovery on VAX fail. The correct syntax is F$ENVIRONMENT.
  
  Closes #3407
  Reviewed-by: Viktor Szakats <commit@vszakats.net>

Daniel Stenberg (24 Dec 2018)
- [Ruslan Baratov brought this change]

  cmake: use lowercase for function name like the rest of the code
  
  Reviewed-by: Sergei Nikulov
  
  closes #3196

- Revert "libssh: no data pointer == nothing to do"
  
  This reverts commit c98ee5f67f497195c9 since commit f3ce38739fa fixed the
  problem in a more generic way.

- disconnect: set conn->data for protocol disconnect
  
  Follow-up to fb445a1e18d: Set conn->data explicitly to point out the
  current transfer when invoking the protocol-specific disconnect function
  so that it can work correctly.
  
  Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12173

Jay Satiro (23 Dec 2018)
- [Pavel Pavlov brought this change]

  timeval: Use high resolution timestamps on Windows
  
  - Use QueryPerformanceCounter on Windows Vista+
  
  There is confusing info floating around that QueryPerformanceCounter
  can leap etc, which might have been true long time ago, but no longer
  the case nowadays (perhaps starting from WinXP?). Also, boost and
  std::chrono::steady_clock use QueryPerformanceCounter in a similar way.
  
  Prior to this change GetTickCount or GetTickCount64 was used, which has
  lower resolution. That is still the case for <= XP.
  
  Fixes https://github.com/curl/curl/issues/3309
  Closes https://github.com/curl/curl/pull/3318

Daniel Stenberg (22 Dec 2018)
- libssh: no data pointer == nothing to do

- conncache_unlock: avoid indirection by changing input argument type

- disconnect: separate connections and easy handles better
  
  Do not assume/store assocation between a given easy handle and the
  connection if it can be avoided.
  
  Long-term, the 'conn->data' pointer should probably be removed as it is a
  little too error-prone. Still used very widely though.
  
  Reported-by: masbug on github
  Fixes #3391
  Closes #3400

- libssh: free sftp_canonicalize_path() data correctly
  
  Assisted-by: Harry Sintonen
  
  Fixes #3402
  Closes #3403

- RELEASE-NOTES: synced

- http: added options for allowing HTTP/0.9 responses
  
  Added CURLOPT_HTTP09_ALLOWED and --http0.9 for this purpose.
  
  For now, both the tool and library allow HTTP/0.9 by default.
  docs/DEPRECATE.md lays out the plan for when to reverse that default: 6
  months after the 7.64.0 release. The options are added already now so
  that applications/scripts can start using them already now.
  
  Fixes #2873
  Closes #3383

- if2ip: remove unused function Curl_if_is_interface_name
  
  Closes #3401

- http2: clear pause stream id if it gets closed
  
  Reported-by: Florian Pritz
  
  Fixes #3392
  Closes #3399

Daniel Gustafsson (20 Dec 2018)
- [David Garske brought this change]

  wolfssl: Perform cleanup
  
  This adds a cleanup callback for cyassl. Resolves possible memory leak
  when using ECC fixed point cache.
  
  Closes #3395
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>
  Reviewed-by: Daniel Gustafsson <daniel@yesql.se>

Daniel Stenberg (20 Dec 2018)
- mbedtls: follow-up VERIFYHOST fix from f097669248
  
  Fix-by: Eric Rosenquist
  
  Fixes #3376
  Closes #3390

- curlver: bump to 7.64.0 for next release

Daniel Gustafsson (19 Dec 2018)
- cookies: extend domain checks to non psl builds
  
  Ensure to perform the checks we have to enforce a sane domain in
  the cookie request. The check for non-PSL enabled builds is quite
  basic but it's better than nothing.
  
  Closes #2964
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Daniel Stenberg (19 Dec 2018)
- [Matus Uzak brought this change]

  smb: fix incorrect path in request if connection reused
  
  Follow-up to 09e401e01bf9.  If connection gets reused, then data member
  will be copied, but not the proto member.  As a result, in smb_do(),
  path has been set from the original proto.share data.
  
  Closes #3388

- curl -J: do not append to the destination file
  
  Reported-by: Kamil Dudka
  Fixes #3380
  Closes #3381

- mbedtls: use VERIFYHOST
  
  Previously, VERIFYPEER would enable/disable all checks.
  
  Reported-by: Eric Rosenquist
  Fixes #3376
  Closes #3380

- pingpong: change default response timeout to 120 seconds
  
  Previously it was 30 minutes

- pingpong: ignore regular timeout in disconnect phase
  
  The timeout set with CURLOPT_TIMEOUT is no longer used when
  disconnecting from one of the pingpong protocols (FTP, IMAP, SMTP,
  POP3).
  
  Reported-by: jasal82 on github
  
  Fixes #3264
  Closes #3374

- TODO: Windows: set attribute 'archive' for completed downloads
  
  Closes #3354

- RELEASE-NOTES: synced

- http: minor whitespace cleanup from f464535b

- [Ayoub Boudhar brought this change]

  http: Implement trailing headers for chunked transfers
  
  This adds the CURLOPT_TRAILERDATA and CURLOPT_TRAILERFUNCTION
  options that allow a callback based approach to sending trailing headers
  with chunked transfers.
  
  The test server (sws) was updated to take into account the detection of the
  end of transfer in the case of trailing headers presence.
  
  Test 1591 checks that trailing headers can be sent using libcurl.
  
  Closes #3350

- darwinssl: accept setting max-tls with default min-tls
  
  Reported-by: Andrei Neculau
  Fixes #3367
  Closes #3373

- gopher: fix memory leak from 9026083ddb2a9

- [Leonardo Taccari brought this change]

  test1201: Add a trailing `?' to the selector
  
  This verify that the `?' in the selector is kept as is.
  
  Verifies the fix in #3370

- [Leonardo Taccari brought this change]

  gopher: always include the entire gopher-path in request
  
  After the migration to URL API all octets in the selector after the
  first `?' were interpreted as query and accidentally discarded and not
  passed to the server.
  
  Add a gopherpath to always concatenate possible path and query URL
  pieces.
  
  Fixes #3369
  Closes #3370

- [Leonardo Taccari brought this change]

  urlapi: distinguish possibly empty query
  
  If just a `?' to indicate the query is passed always store a zero length
  query instead of having a NULL query.
  
  This permits to distinguish URL with trailing `?'.
  
  Fixes #3369
  Closes #3370

Daniel Gustafsson (13 Dec 2018)
- OS400: handle memory error in list conversion
  
  Curl_slist_append_nodup() returns NULL when it fails to create a new
  item for the specified list, and since the coding here reassigned the
  new list on top of the old list it would result in a dangling pointer
  and lost memory. Also, in case we hit an allocation failure at some
  point during the conversion, with allocation succeeding again on the
  subsequent call(s) we will return a truncated list around the malloc
  failure point. Fix by assigning to a temporary list pointer, which can
  be checked (which is the common pattern for slist appending), and free
  all the resources on allocation failure.
  
  Closes #3372
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

- cookies: leave secure cookies alone
  
  Only allow secure origins to be able to write cookies with the
  'secure' flag set. This reduces the risk of non-secure origins
  to influence the state of secure origins. This implements IETF
  Internet-Draft draft-ietf-httpbis-cookie-alone-01 which updates
  RFC6265.
  
  Closes #2956
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Daniel Stenberg (13 Dec 2018)
- docs: fix the --tls-max description
  
  Reported-by: Tobias Lindgren
  Pointed out in #3367
  
  Closes #3368

Daniel Gustafsson (12 Dec 2018)
- urlapi: Fix port parsing of eol colon
  
  A URL with a single colon without a portnumber should use the default
  port, discarding the colon. Fix, add a testcase and also do little bit
  of comment wordsmithing.
  
  Closes #3365
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Version 7.63.0 (12 Dec 2018)

Daniel Stenberg (12 Dec 2018)
- RELEASE-NOTES: 7.63.0

- THANKS: from the curl 7.62.0 cycle

- test1519: use lib1518 and test CURLINFO_REDIRECT_URL more

- Curl_follow: extract the Location: header field unvalidated
  
  ... when not actually following the redirect. Otherwise we return error
  for this and an application can't extract the value.
  
  Test 1518 added to verify.
  
  Reported-by: Pavel Pavlov
  Fixes #3340
  Closes #3364

- multi: convert two timeout variables to timediff_t
  
  The time_t type is unsigned on some systems and these variables are used
  to hold return values from functions that return timediff_t
  already. timediff_t is always a signed type.
  
  Closes #3363

- delta: use --diff-filter on the git diff-tree invokes
  
  Suggested-by: Dave Reisner

Patrick Monnerat (11 Dec 2018)
- documentation: curl_formadd field and file names are now escaped
  
  Prior to 7.56.0, fieldnames and filenames were set in Content-Disposition
  header without special processing: this may lead to invalid RFC 822
  quoted-strings.
  7.56.0 introduces escaping of backslashes and double quotes in these names:
  mention it in the documentation.
  
  Reported-by: daboul on github
  Closes #3361

Daniel Stenberg (11 Dec 2018)
- scripts/delta: show repo delta info from last release
  
  ... where "last release" should be the git tag in the repo.

Daniel Gustafsson (11 Dec 2018)
- tests: add urlapi unittest
  
  This adds a new unittest intended to cover the internal functions in
  the urlapi code, starting with parse_port(). In order to avoid name
  collisions in debug builds, parse_port() is renamed Curl_parse_port()
  since it will be exported.
  
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>
  Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>

- urlapi: fix portnumber parsing for ipv6 zone index
  
  An IPv6 URL which contains a zone index includes a '%%25<zode id>'
  string before the ending ']' bracket. The parsing logic wasn't set
  up to cope with the zone index however, resulting in a malformed url
  error being returned. Fix by breaking the parsing into two stages
  to correctly handle the zone index.
  
  Closes #3355
  Closes #3319
  Reported-by: tonystz on Github
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>
  Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>

Daniel Stenberg (11 Dec 2018)
- [Jay Satiro brought this change]

  http: fix HTTP auth to include query in URI
  
  - Include query in the path passed to generate HTTP auth.
  
  Recent changes to use the URL API internally (46e1640, 7.62.0)
  inadvertently broke authentication URIs by omitting the query.
  
  Fixes https://github.com/curl/curl/issues/3353
  Closes #3356

- [Michael Kaufmann brought this change]

  http: don't set CURLINFO_CONDITION_UNMET for http status code 204
  
  The http status code 204 (No Content) should not change the "condition
  unmet" flag. Only the http status code 304 (Not Modified) should do
  this.
  
  Closes #359

- [Samuel Surtees brought this change]

  ldap: fix LDAP URL parsing regressions
  
  - Match URL scheme with LDAP and LDAPS
  - Retrieve attributes, scope and filter from URL query instead
  
  Regression brought in 46e164069d1a5230 (7.62.0)
  
  Closes #3362

- RELEASE-NOTES: synced

- [Stefan Kanthak brought this change]

  (lib)curl.rc: fixup for minor bugs
  
  All resources defined in lib/libcurl.rc and curl.rc are language
  neutral.
  
  winbuild/MakefileBuild.vc ALWAYS defines the macro DEBUGBUILD, so the
  ifdef's in line 33 of lib/libcurl.rc and src/curl.rc are wrong.
  
  Replace the hard-coded constants in both *.rc files with #define'd
  values.
  
  Thumbs-uped-by: Rod Widdowson, Johannes Schindelin
  URL: https://curl.haxx.se/mail/lib-2018-11/0000.html
  Closes #3348

- test329: verify cookie max-age=0 immediate expiry

- cookies: expire "Max-Age=0" immediately
  
  Reported-by: Jeroen Ooms
  Fixes #3351
  Closes #3352

- [Johannes Schindelin brought this change]

  Upon HTTP_1_1_REQUIRED, retry the request with HTTP/1.1
  
  This is a companion patch to cbea2fd2c (NTLM: force the connection to
  HTTP/1.1, 2018-12-06): with NTLM, we can switch to HTTP/1.1
  preemptively. However, with other (Negotiate) authentication it is not
  clear to this developer whether there is a way to make it work with
  HTTP/2, so let's try HTTP/2 first and fall back in case we encounter the
  error HTTP_1_1_REQUIRED.
  
  Note: we will still keep the NTLM workaround, as it avoids an extra
  round trip.
  
  Daniel Stenberg helped a lot with this patch, in particular by
  suggesting to introduce the Curl_h2_http_1_1_error() function.
  
  Closes #3349
  
  Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

- [Ben Greear brought this change]

  openssl: fix unused variable compiler warning with old openssl
  
  URL: https://curl.haxx.se/mail/lib-2018-11/0055.html
  
  Closes #3347

- [Johannes Schindelin brought this change]

  NTLM: force the connection to HTTP/1.1
  
  Since v7.62.0, cURL tries to use HTTP/2 whenever the server announces
  the capability. However, NTLM authentication only works with HTTP/1.1,
  and will likely remain in that boat (for details, see
  https://docs.microsoft.com/en-us/iis/get-started/whats-new-in-iis-10/http2-on-iis#when-is-http2-not-supported).
  
  When we just found out that we want to use NTLM, and when the current
  connection runs in HTTP/2 mode, let's force the connection to be closed
  and to be re-opened using HTTP/1.1.
  
  Fixes https://github.com/curl/curl/issues/3341.
  Closes #3345
  
  Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

- [Johannes Schindelin brought this change]

  curl_global_sslset(): id == -1 is not necessarily an error
  
  It is allowed to call that function with id set to -1, specifying the
  backend by the name instead. We should imitate what is done further down
  in that function to allow for that.
  
  Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
  
  Closes #3346

Johannes Schindelin (6 Dec 2018)
- .gitattributes: make tabs in indentation a visible error
  
  Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Daniel Stenberg (6 Dec 2018)
- RELEASE-NOTES: synced

- doh: fix memory leak in OOM situation
  
  Reviewed-by: Daniel Gustafsson
  Closes #3342

- doh: make it work for h2-disabled builds too
  
  Reported-by: dtmsecurity at github
  Fixes #3325
  Closes #3336

- packages: remove old leftover files and dirs
  
  This subdir has mostly become an attic of never-used cruft from the
  past.
  
  Closes #3331

- [Gergely Nagy brought this change]

  openssl: do not use file BIOs if not requested
  
  Moves the file handling BIO calls to the branch of the code where they
  are actually used.
  
  Closes #3339

- [Paul Howarth brought this change]

  nss: Fix compatibility with nss versions 3.14 to 3.15

- [Paul Howarth brought this change]

  nss: Improve info message when falling back SSL protocol
  
  Use descriptive text strings rather than decimal numbers.

- [Paul Howarth brought this change]

  nss: Fall back to latest supported SSL version
  
  NSS may be built without support for the latest SSL/TLS versions,
  leading to "SSL version range is not valid" errors when the library
  code supports a recent version (e.g. TLS v1.3) but it has explicitly
  been disabled.
  
  This change adjusts the maximum SSL version requested by libcurl to
  be the maximum supported version at runtime, as long as that version
  is at least as high as the minimum version required by libcurl.
  
  Fixes #3261

Daniel Gustafsson (3 Dec 2018)
- travis: enable COPYRIGHTYEAR extended warning
  
  The extended warning for checking incorrect COPYRIGHTYEAR is quite
  expensive to run, so rather than expecting every developer to do it
  we ensure it's turned on locally for Travis.

- checksrc: add COPYRIGHTYEAR check
  
  Forgetting to bump the year in the copyright clause when hacking has
  been quite common among curl developers, but a traditional checksrc
  check isn't a good fit as it would penalize anyone hacking on January
  1st (among other things). This adds a more selective COPYRIGHTYEAR
  check which intends to only cover the currently hacked on changeset.
  
  The check for updated copyright year is currently not enforced on all
  files but only on files edited and/or committed locally. This is due to
  the amount of files which aren't updated with their correct copyright
  year at the time of their respective commit.
  
  To further avoid running this expensive check for every developer, it
  adds a new local override mode for checksrc where a .checksrc file can
  be used to turn on extended warnings locally.
  
  Closes #3303
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Daniel Stenberg (3 Dec 2018)
- CHECKSRC.md: document more warnings
  
  Closes #3335
  [ci skip]

- RELEASE-NOTES: synced

- SECURITY-PROCESS: bountygraph shuts down
  
  This backpedals back the documents to the state before bountygraph.
  
  Closes #3311

- curl: fix memory leak reading --writeout from file
  
  If another string had been set first, the writout function for reading
  the syntax from file would leak the previously allocated memory.
  
  Reported-by: Brian Carpenter
  Fixes #3322
  Closes #3330

- tool_main: rename function to make it unique and better
  
  ... there's already another function in the curl tool named
  free_config_fields!

Daniel Gustafsson (29 Nov 2018)
- TODO: remove CURLOPT_DNS_USE_GLOBAL_CACHE entry
  
  Commit 7c5837e79280e6abb3ae143dfc49bca5e74cdd11 deprecated the option
  making it a manual code-edit operation to turn it back on. The removal
  process has thus started and is now documented in docs/DEPRECATE.md so
  remove from the TODO to avoid anyone looking for something to pick up
  spend cycles on an already in-progress entry.
  
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Jay Satiro (29 Nov 2018)
- [Sevan Janiyan brought this change]

  connect: fix building for recent versions of Minix
  
  EBADIOCTL doesn't exist on more recent Minix.
  There have also been substantial changes to the network stack.
  Fixes build on Minix 3.4rc
  
  Closes https://github.com/curl/curl/pull/3323

- [Konstantin Kushnir brought this change]

  CMake: fix MIT/Heimdal Kerberos detection
  
  - fix syntax error in FindGSS.cmake
  - correct krb5 include directory. FindGSS exports
    "GSS_INCLUDE_DIR" variable.
  
  Closes https://github.com/curl/curl/pull/3316

Daniel Stenberg (28 Nov 2018)
- test328: verify Content-Encoding: none
  
  Because of issue #3315
  
  Closes #3317

- [James Knight brought this change]

  configure: include all libraries in ssl-libs fetch
  
  When compiling a collection of SSL libraries to link against (SSL_LIBS),
  ensure all libraries are included. The call `--libs-only-l` can produce
  only a subset of found in a `--libs` call (e.x. pthread may be excluded).
  Adding `--libs-only-other` ensures other libraries are also included in
  the list. This corrects select build environments compiling against a
  static version of OpenSSL. Before the change, the following could be
  observed:
  
      checking for openssl options with pkg-config... found
      configure: pkg-config: SSL_LIBS: "-lssl -lz -ldl -lcrypto -lz -ldl "
      configure: pkg-config: SSL_LDFLAGS: "-L/home/jdknight/<workdir>/staging/usr/lib -L/home/jdknight/<workdir>/staging/usr/lib "
      configure: pkg-config: SSL_CPPFLAGS: "-I/home/jdknight/<workdir>/staging/usr/include "
      checking for HMAC_Update in -lcrypto... no
      checking for HMAC_Init_ex in -lcrypto... no
      checking OpenSSL linking with -ldl... no
      checking OpenSSL linking with -ldl and -lpthread... no
      configure: WARNING: SSL disabled, you will not be able to use HTTPS, FTPS, NTLM and more.
      configure: WARNING: Use --with-ssl, --with-gnutls, --with-polarssl, --with-cyassl, --with-nss, --with-axtls, --with-winssl, or --with-darwinssl to address this.
      ...
      SSL support:      no      (--with-{ssl,gnutls,nss,polarssl,mbedtls,cyassl,axtls,winssl,darwinssl} )
      ...
  
  And include the other libraries when compiling SSL_LIBS succeeds with:
  
      checking for openssl options with pkg-config... found
      configure: pkg-config: SSL_LIBS: "-lssl -lz -ldl -pthread -lcrypto -lz -ldl -pthread "
      configure: pkg-config: SSL_LDFLAGS: "-L/home/jdknight/<workdir>/staging/usr/lib -L/home/jdknight/<workdir>/staging/usr/lib "
      configure: pkg-config: SSL_CPPFLAGS: "-I/home/jdknight/<workdir>/staging/usr/include "
      checking for HMAC_Update in -lcrypto... yes
      checking for SSL_connect in -lssl... yes
      ...
      SSL support:      enabled (OpenSSL)
      ...
  
  Signed-off-by: James Knight <james.d.knight@live.com>
  Closes #3193

Daniel Gustafsson (26 Nov 2018)
- doh: fix typo in infof call
  
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

- cmdline-opts/gen.pl: define the correct varname
  
  The variable definition had a small typo making it declare another
  variable then the intended.
  
  Closes #3304
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Daniel Stenberg (25 Nov 2018)
- RELEASE-NOTES: synced

- curl_easy_perform: fix timeout handling
  
  curl_multi_wait() was erroneously used from within
  curl_easy_perform(). It could lead to it believing there was no socket
  to wait for and then instead sleep for a while instead of monitoring the
  socket and then miss acting on that activity as swiftly as it should
  (causing an up to 1000 ms delay).
  
  Reported-by: Antoni Villalonga
  Fixes #3305
  Closes #3306
  Closes #3308

- CURLOPT_WRITEFUNCTION.3: spell out that it gets called many times

- cookies: create the cookiejar even if no cookies to save
  
  Important for when the file is going to be read again and thus must not
  contain old contents!
  
  Adds test 327 to verify.
  
  Reported-by: daboul on github
  Fixes #3299
  Closes #3300

- checksrc: ban snprintf use, add command line flag to override warns

- snprintf: renamed and we now only use msnprintf()
  
  The function does not return the same value as snprintf() normally does,
  so readers may be mislead into thinking the code works differently than
  it actually does. A different function name makes this easier to detect.
  
  Reported-by: Tomas Hoger
  Assisted-by: Daniel Gustafsson
  Fixes #3296
  Closes #3297

- [Tobias Hintze brought this change]

  test: update test20/1322 for eglibc bug workaround
  
  The tests 20 and 1322 are using getaddrinfo of libc for resolving. In
  eglibc-2.19 there is a memory leakage and invalid free bug which
  surfaces in some special circumstances (PF_UNSPEC hint with invalid or
  non-existent names). The valgrind runs in testing fail in these
  situations.
  
  As the tests 20/1322 are not specific on either protocol (IPv4/IPv6)
  this commit changes the hints to IPv4 protocol by passing `--ipv4` flag
  on the tests' command line.  This prevents the valgrind failures.

- [Tobias Hintze brought this change]

  host names: allow trailing dot in name resolve, then strip it
  
  Delays stripping of trailing dots to after resolving the hostname.
  
  Fixes #3022
  Closes #3222

- [UnknownShadow200 brought this change]

  CURLOPT_HEADERFUNCTION.3: match 'nitems' name in synopsis and description
  
  Closes #3295

Daniel Gustafsson (21 Nov 2018)
- configure: Fix typo in comment

Michael Kaufmann (21 Nov 2018)
- openssl: support session resume with TLS 1.3
  
  Session resumption information is not available immediately after a TLS 1.3
  handshake. The client must wait until the server has sent a session ticket.
  
  Use OpenSSL's "new session" callback to get the session information and put it
  into curl's session cache. For TLS 1.3 sessions, this callback will be invoked
  after the server has sent a session ticket.
  
  The "new session" callback is invoked only if OpenSSL's session cache is
  enabled, so enable it and use the "external storage" mode which lets curl manage
  the contents of the session cache.
  
  A pointer to the connection data and the sockindex are now saved as "SSL extra
  data" to make them available to the callback.
  
  This approach also works for old SSL/TLS versions and old OpenSSL versions.
  
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>
  
  Fixes #3202
  Closes #3271

- ssl: fix compilation with OpenSSL 0.9.7
  
  - ENGINE_cleanup() was used without including "openssl/engine.h"
  - enable engine support for OpenSSL 0.9.7
  
  Closes #3266

Daniel Stenberg (21 Nov 2018)
- openssl: disable TLS renegotiation with BoringSSL
  
  Since we're close to feature freeze, this change disables this feature
  with an #ifdef. Define ALLOW_RENEG at build-time to enable.
  
  This could be converted to a bit for CURLOPT_SSL_OPTIONS to let
  applications opt-in this.
  
  Concern-raised-by: David Benjamin
  Fixes #3283
  Closes #3293

- [Romain Fliedel brought this change]

  ares: remove fd from multi fd set when ares is about to close the fd
  
  When using c-ares for asyn dns, the dns socket fd was silently closed
  by c-ares without curl being aware. curl would then 'realize' the fd
  has been removed at next call of Curl_resolver_getsock, and only then
  notify the CURLMOPT_SOCKETFUNCTION to remove fd from its poll set with
  CURL_POLL_REMOVE. At this point the fd is already closed.
  
  By using ares socket state callback (ARES_OPT_SOCK_STATE_CB), this
  patch allows curl to be notified that the fd is not longer needed
  for neither for write nor read. At this point by calling
  Curl_multi_closed we are able to notify multi with CURL_POLL_REMOVE
  before the fd is actually closed by ares.
  
  In asyn-ares.c Curl_resolver_duphandle we can't use ares_dup anymore
  since it does not allow passing a different sock_state_cb_data
  
  Closes #3238

- [Romain Fliedel brought this change]

  examples/ephiperfifo: report error when epoll_ctl fails

Daniel Gustafsson (20 Nov 2018)
- [pkubaj brought this change]

  ntlm: Remove redundant ifdef USE_OPENSSL
  
  lib/curl_ntlm.c had code that read as follows:
  
    #ifdef USE_OPENSSL
    # ifdef USE_OPENSSL
    # else
    # ..
    # endif
    #endif
  
  Remove the redundant USE_OPENSSL along with #else (it's not possible to
  reach it anyway). The removed construction is a leftover from when the
  SSLeay support was removed.
  
  Closes #3269
  Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Daniel Stenberg (20 Nov 2018)
- [Han Han brought this change]

  ssl: replace all internal uses of CURLE_SSL_CACERT
  
  Closes #3291

Han Han (19 Nov 2018)
- docs: add more description to unified ssl error codes

- curle: move deprecated error code to ifndef block

Patrick Monnerat (19 Nov 2018)
- os400: add CURLOPT_CURLU to ILE/RPG binding.

- os400: Add curl_easy_conn_upkeep() to ILE/RPG binding.

- os400: fix return type of curl_easy_pause() in ILE/RPG binding.

Daniel Stenberg (19 Nov 2018)
- RELEASE-NOTES: synced

- impacket: add LICENSE
  
  The license for the impacket package was not in our tree.
  
  Imported now from upstream's
  https://github.com/SecureAuthCorp/impacket/blob/master/LICENSE
  
  Reported-by: infinnovation-dev on github
  Fixes #3276
  Closes #3277

Daniel Gustafsson (18 Nov 2018)
- tool_doswin: Fix uninitialized field warning
  
  The partial struct initialization in 397664a065abffb7c3445ca9 caused
  a warning on uninitialized MODULEENTRY32 struct members:
  
    /src/tool_doswin.c:681:3: warning: missing initializer for field
    'th32ModuleID' of 'MODULEENTRY32 {aka struct tagMODULEENTRY32}'
    [-Wmissing-field-initializers]
  
  This is sort of a bogus warning as the remaining members will be set
  to zero by the compiler, as all omitted members are. Nevertheless,
  remove the warning by omitting all members and setting the dwSize
  members explicitly.
  
  Closes #3254
  Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>
  Reviewed-by: Jay Satiro <raysatiro@yahoo.com>

- openssl: Remove SSLEAY leftovers
  
  Commit 709cf76f6bb7dbac deprecated USE_SSLEAY, as curl since long isn't
  compatible with the SSLeay library. This removes the few leftovers that
  were omitted in the less frequently used platform targets.
  
  Closes #3270
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Daniel Stenberg (16 Nov 2018)
- [Elia Tufarolo brought this change]

  http_negotiate: do not close connection until negotiation is completed
  
  Fix HTTP POST using CURLAUTH_NEGOTIATE.
  
  Closes #3275

- pop3: only do APOP with a valid timestamp
  
  Brought-by: bobmitchell1956 on github
  Fixes #3278
  Closes #3279

Jay Satiro (16 Nov 2018)
- [Peter Wu brought this change]

  openssl: do not log excess "TLS app data" lines for TLS 1.3
  
  The SSL_CTX_set_msg_callback callback is not just called for the
  Handshake or Alert protocols, but also for the raw record header
  (SSL3_RT_HEADER) and the decrypted inner record type
  (SSL3_RT_INNER_CONTENT_TYPE). Be sure to ignore the latter to avoid
  excess debug spam when using `curl -v` against a TLSv1.3-enabled server:
  
      * TLSv1.3 (IN), TLS app data, [no content] (0):
  
  (Following this message, another callback for the decrypted
  handshake/alert messages will be be present anyway.)
  
  Closes https://github.com/curl/curl/pull/3281

Marc Hoersken (15 Nov 2018)
- tests: disable SO_EXCLUSIVEADDRUSE for stunnel on Windows
  
  SO_EXCLUSIVEADDRUSE is on by default on Vista or newer,
  but does not work together with SO_REUSEADDR being on.
  
  The default changes were made with stunnel 5.34 and 5.35.

Daniel Stenberg (13 Nov 2018)
- [Kamil Dudka brought this change]

  nss: remove version selecting dead code
  
  Closes #3262

- nss: set default max-tls to 1.3/1.2
  
  Fixes #3261

Daniel Gustafsson (13 Nov 2018)
- tool_cb_wrt: Silence function cast compiler warning
  
  Commit 5bfaa86ceb3c2a9ac474a928e748c4a86a703b33 introduced a new
  compiler warning on Windows cross compilation with GCC. See below
  for an example of the warning from the autobuild logs (whitespace
  edited to fit):
  
  /src/tool_cb_wrt.c:175:9: warning: cast from function call of type
      'intptr_t {aka long long int}' to non-matching type 'void *'
      [-Wbad-function-cast]
  (HANDLE) _get_osfhandle(fileno(outs->stream)),
  ^
  
  Store the return value from _get_osfhandle() in an intermediate
  variable and cast the variable in WriteConsoleW() rather than the
  function call directly to avoid a compiler warning.
  
  In passing, also add inspection of the MultiByteToWideChar() return
  value and return failure in case an error is reported.
  
  Closes #3263
  Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>
  Reviewed-by: Viktor Szakats <commit@vszakats.net>

Daniel Stenberg (12 Nov 2018)
- nss: fix fallthrough comment to fix picky compiler warning

- docs: expanded on some CURLU details

- [Tim Rühsen brought this change]

  ftp: avoid two unsigned int overflows in FTP listing parser
  
  Curl_ftp_parselist: avoid unsigned integer overflows
  
  The overflow has no real world impact, just avoid it for "best
  practice".
  
  Closes #3225

/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
 * are also available at https://curl.haxx.se/docs/copyright.html.
 *
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 * copies of the Software, and permit persons to whom the Software is

if(NOT UNIX)
  if(WIN32)
    set(HAVE_LIBDL 0)
    set(HAVE_LIBUCB 0)
    set(HAVE_LIBSOCKET 0)
    set(NOT_NEED_LIBNSL 0)
    set(HAVE_LIBNSL 0)
    set(HAVE_GETHOSTNAME 1)
    set(HAVE_LIBZ 0)
    set(HAVE_LIBCRYPTO 0)

    set(HAVE_DLOPEN 0)

    set(HAVE_ALLOCA_H 0)
    set(HAVE_ARPA_INET_H 0)
    set(HAVE_DLFCN_H 0)
    set(HAVE_FCNTL_H 1)

  list(APPEND CURL_LIBS "${COREFOUNDATION_FRAMEWORK}" "${SECURITY_FRAMEWORK}")
endif()

if(CMAKE_USE_OPENSSL)
  find_package(OpenSSL REQUIRED)
  set(SSL_ENABLED ON)
  set(USE_OPENSSL ON)
  set(HAVE_LIBCRYPTO ON)
  set(HAVE_LIBSSL ON)

  # Depend on OpenSSL via imported targets if supported by the running
  # version of CMake.  This allows our dependents to get our dependencies
  # transitively.
  if(NOT CMAKE_VERSION VERSION_LESS 3.4)
    list(APPEND CURL_LIBS OpenSSL::SSL OpenSSL::Crypto)
  else()

  pingpong.c rtsp.c curl_threads.c warnless.c hmac.c curl_rtmp.c        \
  openldap.c curl_gethostname.c gopher.c idn_win32.c                    \
  http_proxy.c non-ascii.c asyn-ares.c asyn-thread.c curl_gssapi.c      \
  http_ntlm.c curl_ntlm_wb.c curl_ntlm_core.c curl_sasl.c rand.c        \
  curl_multibyte.c hostcheck.c conncache.c dotdot.c                     \
  x509asn1.c http2.c smb.c curl_endian.c curl_des.c system_win32.c      \
  mime.c sha256.c setopt.c curl_path.c curl_ctype.c curl_range.c psl.c  \
  doh.c urlapi.c curl_get_line.c altsvc.c

LIB_HFILES = arpa_telnet.h netrc.h file.h timeval.h hostip.h progress.h \
  formdata.h cookie.h http.h sendf.h ftp.h url.h dict.h if2ip.h         \
  speedcheck.h urldata.h curl_ldap.h escape.h telnet.h getinfo.h        \
  strcase.h curl_sec.h memdebug.h http_chunks.h curl_fnmatch.h          \
  wildcard.h fileinfo.h ftplistparser.h strtok.h connect.h llist.h      \
  hash.h content_encoding.h share.h curl_md4.h curl_md5.h http_digest.h \
  http_negotiate.h inet_pton.h amigaos.h strtoofft.h strerror.h         \
  inet_ntop.h curlx.h curl_memory.h curl_setup.h transfer.h select.h    \
  easyif.h multiif.h parsedate.h tftp.h sockaddr.h splay.h strdup.h     \
  socks.h ssh.h curl_base64.h curl_addrinfo.h curl_sspi.h      \
  slist.h nonblock.h curl_memrchr.h imap.h pop3.h smtp.h pingpong.h     \
  rtsp.h curl_threads.h warnless.h curl_hmac.h curl_rtmp.h              \
  curl_gethostname.h gopher.h http_proxy.h non-ascii.h asyn.h           \
  http_ntlm.h curl_gssapi.h curl_ntlm_wb.h curl_ntlm_core.h             \
  curl_sasl.h curl_multibyte.h hostcheck.h conncache.h                  \
  curl_setup_once.h multihandle.h setup-vms.h dotdot.h                  \
  x509asn1.h http2.h sigpipe.h smb.h curl_endian.h curl_des.h           \
  curl_printf.h system_win32.h rand.h mime.h curl_sha256.h setopt.h     \
  curl_path.h curl_ctype.h curl_range.h psl.h doh.h urlapi-int.h        \
  curl_get_line.h altsvc.h quic.h

LIB_RCFILES = libcurl.rc
CSOURCES = $(LIB_CFILES) $(LIB_VAUTH_CFILES) $(LIB_VTLS_CFILES) \
  $(LIB_VQUIC_CFILES) $(LIB_VSSH_CFILES)

HHEADERS = $(LIB_HFILES) $(LIB_VAUTH_HFILES) $(LIB_VTLS_HFILES) \
  $(LIB_VQUIC_HFILES)

curl and libcurl 7.66.0

 Public curl releases:         185
 Command line options:         225
 curl_easy_setopt() options:   269
 Public functions in libcurl:  81
 Contributors:                 1991

This release includes the following changes:

 o CURLINFO_RETRY_AFTER: parse the Retry-After header value [35]
 o HTTP3: initial (experimental still not working) support [5]
 o curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool [27]
 o curl: support parallel transfers with -Z [4]
 o curl_multi_poll: a sister to curl_multi_wait() that waits more [28]
 o sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID [27]



This release includes the following bugfixes:

 o CVE-2019-5481: FTP-KRB double-free [64]
 o CVE-2019-5482: TFTP small blocksize heap buffer overflow [65]
 o CI: remove duplicate configure flag for LGTM.com
 o CMake: remove needless newlines at end of gss variables
 o CMake: use platform dependent name for dlopen() library [62]
 o CURLINFO docs: mention that in redirects times are added [55]
 o CURLOPT_ALTSVC.3: use a "" file name to not load from a file
 o CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED

 o CURLOPT_HEADERFUNCTION.3: clarify [54]
 o CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly [33]
 o CURLOPT_READFUNCTION.3: provide inline example
 o CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2 [51]
 o Curl_addr2string: take an addrlen argument too [61]
 o Curl_fillreadbuffer: avoid double-free trailer buf on error [66]
 o HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown [10]
 o alt-svc: add protocol version selection masking [31]
 o alt-svc: fix removal of expired cache entry [30]
 o alt-svc: make it use h3-22 with ngtcp2 as well
 o alt-svc: more liberal ALPN name parsing [17]
 o alt-svc: send Alt-Used: in redirected requests [32]
 o alt-svc: with quiche, use the quiche h3 alpn string [16]



 o appveyor: pass on -k to make





 o asyn-thread: create a socketpair to wait on [14]




 o build-openssl: fix build with Visual Studio 2019 [45]

 o cleanup: move functions out of url.c and make them static [58]

 o cleanup: remove the 'numsocks' argument used in many places [25]



 o configure: avoid undefined check_for_ca_bundle [37]
 o curl.h: add CURL_HTTP_VERSION_3 to the version enum

 o curl.h: fix outdated comment [23]


 o curl: cap the maximum allowed values for retry time arguments [13]
 o curl: handle a libcurl build without netrc support [63]
 o curl: make use of CURLINFO_RETRY_AFTER when retrying [35]
 o curl: remove outdated comment [24]
 o curl: use .curlrc (with a dot) on Windows [52]
 o curl: use CURLINFO_PROTOCOL to check for HTTP(s)

 o curl_global_init_mem.3: mention it was added in 7.12.0





 o curl_version: bump string buffer size to 250
 o curl_version_info.3: mentioned ALTSVC and HTTP3
 o curl_version_info: offer quic (and h3) library info [38]
 o curl_version_info: provide nghttp2 details [2]

 o defines: avoid underscore-prefixed defines [47]
 o docs/ALTSVC: remove what works and the experimental explanation [34]
 o docs/EXPERIMENTAL: explain what it means and what's experimental now
 o docs/MANUAL.md: converted to markdown from plain text [3]
 o docs/examples/curlx: fix errors [48]
 o docs: s/curl_debug/curl_dbg_debug in comments and docs [36]
 o easy: resize receive buffer on easy handle reset [9]
 o examples: Avoid reserved names in hiperfifo examples [8]
 o examples: add http3.c, altsvc.c and http3-present.c [40]
 o getenv: support up to 4K environment variable contents on windows [21]

 o http09: disable HTTP/0.9 by default in both tool and library [29]
 o http2: when marked for closure and wanted to close == OK [56]

 o http2_recv: trigger another read when the last data is returned [11]
 o http: fix use of credentials from URL when using HTTP proxy [44]




 o http_negotiate: improve handling of gss_init_sec_context() failures [18]
 o md4: Use our own MD4 when no crypto libraries are available [15]
 o multi: call detach_connection before Curl_disconnect [6]
 o netrc: make the code try ".netrc" on Windows [52]

 o nss: use TLSv1.3 as default if supported [39]










 o openssl: build warning free with boringssl [50]
 o openssl: use SSL_CTX_set_<min|max>_proto_version() when available [68]
 o plan9: add support for running on Plan 9 [22]
 o progress: reset download/uploaded counter between transfers [12]
 o readwrite_data: repair setting the TIMER_STARTTRANSFER stamp [26]
 o scp: fix directory name length used in memcpy [46]
 o smb: init *msg to NULL in smb_send_and_recv() [60]
 o smtp: check for and bail out on too short EHLO response [59]
 o source: remove names from source comments [1]
 o spnego_sspi: add typecast to fix build warning [49]
 o src/makefile: fix uncompressed hugehelp.c generation [19]
 o ssh-libssh: do not specify O_APPEND when not in append mode [7]
 o ssh: move code into vssh for SSH backends [53]
 o sspi: fix memory leaks [67]

 o tests: Replace outdated test case numbering documentation [43]

 o tftp: return error when packet is too small for options
 o timediff: make it 64 bit (if possible) even with 32 bit time_t [20]
 o travis: reduce number of torture tests in 'coverage' [42]



 o url: make use of new HTTP version if alt-svc has one [16]



 o urlapi: verify the IPv6 numerical address [69]

 o urldata: avoid 'generic', use dedicated pointers [57]





 o vauth: Use CURLE_AUTH_ERROR for auth function errors [41]

This release includes the following known bugs:

 o see docs/KNOWN_BUGS (https://curl.haxx.se/docs/knownbugs.html)

This release would not have looked like this without help, code, reports and
advice from friends like these:

  Alessandro Ghedini, Alex Mayorga, Amit Katyal, Balazs Kovacsics,

  Brad Spencer, Brandon Dong, Carlo Marcelo Arenas Belón, Christopher Head,
  Clément Notin, codesniffer13 on github, Daniel Gustafsson, Daniel Stenberg,
  Dominik Hölzl, Eric Wong, Felix Hädicke, Gergely Nagy, Gisle Vanem,


  Igor Makarov, Ironbars13 on github, Jason Lee, Jeremy Lainé,
  Jonathan Cardoso Machado, Junho Choi, Kamil Dudka, Kyle Abramowitz,
  Kyohei Kadota, Lance Ware, Marcel Raad, Max Dymond, Michael Lee,
  Michal Čaplygin, migueljcrum on github, Mike Crowe, niallor on github,

  osabc on github, patnyb on github, Patrick Monnerat, Peter Wu, Ray Satiro,
  Rolf Eike Beer, Steve Holme, Tatsuhiro Tsujikawa, The Infinnovation team,



  Thomas Vegas, Tom van der Woerdt, Yiming Jing,

  (46 contributors)

        Thanks! (and sorry if I forgot to mention someone)

References to bug reports and discussions on issues:

 [1] = https://curl.haxx.se/bug/?i=4129
 [2] = https://curl.haxx.se/bug/?i=4121
 [3] = https://curl.haxx.se/bug/?i=4131
 [4] = https://curl.haxx.se/bug/?i=3804
 [5] = https://curl.haxx.se/bug/?i=3500
 [6] = https://curl.haxx.se/bug/?i=4144
 [7] = https://curl.haxx.se/bug/?i=4147
 [8] = https://curl.haxx.se/bug/?i=4153
 [9] = https://curl.haxx.se/bug/?i=4143
 [10] = https://curl.haxx.se/bug/?i=4138
 [11] = https://curl.haxx.se/bug/?i=4043
 [12] = https://curl.haxx.se/bug/?i=4084
 [13] = https://curl.haxx.se/bug/?i=4166
 [14] = https://curl.haxx.se/bug/?i=4157
 [15] = https://curl.haxx.se/bug/?i=3780
 [16] = https://curl.haxx.se/bug/?i=4183




















 [17] = https://curl.haxx.se/bug/?i=4182
 [18] = https://curl.haxx.se/bug/?i=3992
 [19] = https://curl.haxx.se/bug/?i=4176
 [20] = https://curl.haxx.se/bug/?i=4165
 [21] = https://curl.haxx.se/bug/?i=4174
 [22] = https://curl.haxx.se/bug/?i=3701
 [23] = https://curl.haxx.se/bug/?i=4167
 [24] = https://curl.haxx.se/bug/?i=4172
 [25] = https://curl.haxx.se/bug/?i=4169
 [26] = https://curl.haxx.se/bug/?i=4136
 [27] = https://curl.haxx.se/bug/?i=3653
 [28] = https://curl.haxx.se/bug/?i=4163
 [29] = https://curl.haxx.se/bug/?i=4191
 [30] = https://curl.haxx.se/bug/?i=4192
 [31] = https://curl.haxx.se/bug/?i=4201
 [32] = https://curl.haxx.se/bug/?i=4199
 [33] = https://curl.haxx.se/bug/?i=4197










 [34] = https://curl.haxx.se/bug/?i=4198
 [35] = https://curl.haxx.se/bug/?i=3794
 [36] = https://curl.haxx.se/bug/?i=3794
 [37] = https://curl.haxx.se/bug/?i=4213
 [38] = https://curl.haxx.se/bug/?i=4216
 [39] = https://curl.haxx.se/bug/?i=4187
 [40] = https://curl.haxx.se/bug/?i=4221
 [41] = https://curl.haxx.se/bug/?i=3848
 [42] = https://curl.haxx.se/bug/?i=4223
 [43] = https://curl.haxx.se/bug/?i=4227
 [44] = https://curl.haxx.se/bug/?i=4228
 [45] = https://curl.haxx.se/bug/?i=4188
 [46] = https://curl.haxx.se/bug/?i=4258
 [47] = https://curl.haxx.se/bug/?i=4254
 [48] = https://curl.haxx.se/bug/?i=4248
 [49] = https://curl.haxx.se/bug/?i=4245
 [50] = https://curl.haxx.se/bug/?i=4244
 [51] = https://curl.haxx.se/bug/?i=4241










 [52] = https://curl.haxx.se/bug/?i=4230
 [53] = https://curl.haxx.se/bug/?i=4235
 [54] = https://curl.haxx.se/bug/?i=4273
 [55] = https://curl.haxx.se/bug/?i=4250
 [56] = https://curl.haxx.se/bug/?i=4267
 [57] = https://curl.haxx.se/bug/?i=4290
 [58] = https://curl.haxx.se/bug/?i=4289
 [59] = https://curl.haxx.se/bug/?i=4287
 [60] = https://curl.haxx.se/bug/?i=4286
 [61] = https://curl.haxx.se/bug/?i=4283
 [62] = https://curl.haxx.se/bug/?i=4279

 [63] = https://curl.haxx.se/bug/?i=4302
 [64] = https://curl.haxx.se/docs/CVE-2019-5481.html
 [65] = https://curl.haxx.se/docs/CVE-2019-5482.html
 [66] = https://curl.haxx.se/bug/?i=4307
 [67] = https://curl.haxx.se/bug/?i=4299
 [68] = https://curl.haxx.se/bug/?i=4304
 [69] = https://curl.haxx.se/bug/?i=4315

@echo off
rem ***************************************************************************
rem *                                  _   _ ____  _
rem *  Project                     ___| | | |  _ \| |
rem *                             / __| | | | |_) | |
rem *                            | (__| |_| |  _ <| |___
rem *                             \___|\___/|_| \_\_____|
rem *
rem * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
rem *
rem * This software is licensed as described in the file COPYING, which
rem * you should have received as part of this distribution. The terms
rem * are also available at https://curl.haxx.se/docs/copyright.html.
rem *
rem * You may opt to use, copy, modify, merge, publish, distribute and/or sell
rem * copies of the Software, and permit persons to whom the Software is

enable_warnings
enable_werror
enable_curldebug
enable_symbol_hiding
enable_hidden_symbols
enable_ares
enable_rt

enable_code_coverage
enable_dependency_tracking
enable_largefile
enable_shared
enable_static
with_pic
enable_fast_install

with_amissl
with_ssl
with_egd_socket
with_random
enable_openssl_auto_load_config
with_gnutls
with_mbedtls
with_cyassl
with_wolfssl
with_mesalink
with_nss
with_ca_bundle
with_ca_path
with_ca_fallback
with_libpsl

  --disable-symbol-hiding Disable hiding of library internal symbols
  --enable-hidden-symbols To be deprecated, use --enable-symbol-hiding
  --disable-hidden-symbols
                          To be deprecated, use --disable-symbol-hiding
  --enable-ares[=PATH]    Enable c-ares for DNS lookups
  --disable-ares          Disable c-ares for DNS lookups
  --disable-rt            disable dependency on -lrt


  --enable-code-coverage  Provide code coverage
  --enable-dependency-tracking
                          do not reject slow dependency extractors
  --disable-dependency-tracking
                          speeds up one-time build
  --disable-largefile     omit support for large files
  --enable-shared[=PKGS]  build shared libraries [default=yes]

  --with-random=FILE      read randomness from FILE (default=/dev/urandom)
  --with-gnutls=PATH      where to look for GnuTLS, PATH points to the
                          installation root
  --without-gnutls        disable GnuTLS detection
  --with-mbedtls=PATH     where to look for mbedTLS, PATH points to the
                          installation root
  --without-mbedtls       disable mbedTLS detection
  --with-cyassl=PATH      where to look for CyaSSL, PATH points to the
                          installation root (default: system lib default)
  --without-cyassl        disable CyaSSL detection
  --with-wolfssl=PATH     where to look for WolfSSL, PATH points to the
                          installation root (default: system lib default)
  --without-wolfssl       disable WolfSSL detection
  --with-mesalink=PATH    where to look for MesaLink, PATH points to the
                          installation root
  --without-mesalink      disable MesaLink detection
  --with-nss=PATH         where to look for NSS, PATH points to the

    *)
            dontwant_rt="no"
      { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
$as_echo "no" >&6; }
      ;;
  esac

































#
# Check that 'XC_CONFIGURE_PREAMBLE' has already run.
#

if test -z "$xc_configure_preamble_result"; then
  as_fn_error $? "xc_configure_preamble_result not set (internal problem)" "$LINENO" 5

rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
  conftest.$ac_objext conftest.beam conftest.$ac_ext
fi

fi


if test "$ipv6" = "yes"; then
  curl_ipv6_msg="enabled"
fi

# Check if struct sockaddr_in6 have sin6_scope_id member
if test "$ipv6" = yes; then
  { $as_echo "$as_me:${as_lineno-$LINENO}: checking if struct sockaddr_in6 has sin6_scope_id member" >&5
$as_echo_n "checking if struct sockaddr_in6 has sin6_scope_id member... " >&6; }
  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h.  */

fi


OPT_WOLFSSL=no

_cppflags=$CPPFLAGS
_ldflags=$LDFLAGS

# Check whether --with-cyassl was given.
if test "${with_cyassl+set}" = set; then :
  withval=$with_cyassl; OPT_WOLFSSL=$withval
fi



# Check whether --with-wolfssl was given.
if test "${with_wolfssl+set}" = set; then :
  withval=$with_wolfssl; OPT_WOLFSSL=$withval
fi


if test -z "$ssl_backends" -o "x$OPT_WOLFSSL" != xno; then
  ssl_msg=

  if test X"$OPT_WOLFSSL" != Xno; then

    if test "$OPT_WOLFSSL" = "yes"; then
      OPT_WOLFSSL=""
    fi


    cyassllibname=cyassl

    if test -z "$OPT_WOLFSSL" ; then

      { $as_echo "$as_me:${as_lineno-$LINENO}: checking for CyaSSL_Init in -lcyassl" >&5
$as_echo_n "checking for CyaSSL_Init in -lcyassl... " >&6; }
if ${ac_cv_lib_cyassl_CyaSSL_Init+:} false; then :
  $as_echo_n "(cached) " >&6
else
  ac_check_lib_save_LIBS=$LIBS
LIBS="-lcyassl  $LIBS"
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h.  */


#ifdef __cplusplus
extern "C"
#endif
char CyaSSL_Init ();
int main (void)
{
return CyaSSL_Init ();
 ;
 return 0;
}
_ACEOF
if ac_fn_c_try_link "$LINENO"; then :
  ac_cv_lib_cyassl_CyaSSL_Init=yes
else
  ac_cv_lib_cyassl_CyaSSL_Init=no
fi
rm -f core conftest.err conftest.$ac_objext \
    conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_cyassl_CyaSSL_Init" >&5
$as_echo "$ac_cv_lib_cyassl_CyaSSL_Init" >&6; }
if test "x$ac_cv_lib_cyassl_CyaSSL_Init" = xyes; then :


$as_echo "#define USE_WOLFSSL 1" >>confdefs.h

         USE_WOLFSSL=1

         WOLFSSL_ENABLED=1
         USE_WOLFSSL="yes"
         ssl_msg="CyaSSL"
	 test cyassl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes

fi

    fi

    addld=""
    addlib=""
    addcflags=""
    cyassllib=""

    if test "x$USE_WOLFSSL" != "xyes"; then
            addld=-L$OPT_WOLFSSL/lib$libsuff
      addcflags=-I$OPT_WOLFSSL/include
      cyassllib=$OPT_WOLFSSL/lib$libsuff

      LDFLAGS="$LDFLAGS $addld"
      if test "$addcflags" != "-I/usr/include"; then
         CPPFLAGS="$CPPFLAGS $addcflags"
      fi

      { $as_echo "$as_me:${as_lineno-$LINENO}: checking for CyaSSL_Init in -lcyassl" >&5
$as_echo_n "checking for CyaSSL_Init in -lcyassl... " >&6; }
if ${ac_cv_lib_cyassl_CyaSSL_Init+:} false; then :
  $as_echo_n "(cached) " >&6
else
  ac_check_lib_save_LIBS=$LIBS
LIBS="-lcyassl  $LIBS"
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h.  */


#ifdef __cplusplus
extern "C"
#endif
char CyaSSL_Init ();
int main (void)
{
return CyaSSL_Init ();
 ;
 return 0;
}
_ACEOF
if ac_fn_c_try_link "$LINENO"; then :
  ac_cv_lib_cyassl_CyaSSL_Init=yes
else
  ac_cv_lib_cyassl_CyaSSL_Init=no
fi
rm -f core conftest.err conftest.$ac_objext \
    conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_cyassl_CyaSSL_Init" >&5
$as_echo "$ac_cv_lib_cyassl_CyaSSL_Init" >&6; }
if test "x$ac_cv_lib_cyassl_CyaSSL_Init" = xyes; then :


$as_echo "#define USE_WOLFSSL 1" >>confdefs.h

       USE_WOLFSSL=1

       WOLFSSL_ENABLED=1
       USE_WOLFSSL="yes"
       ssl_msg="CyaSSL"
       test cyassl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes

else

         CPPFLAGS=$_cppflags
         LDFLAGS=$_ldflags
         cyassllib=""

fi

    fi

    addld=""
    addlib=""
    addcflags=""

    if test "x$USE_WOLFSSL" != "xyes"; then
            addld=-L$OPT_WOLFSSL/lib$libsuff
      addcflags=-I$OPT_WOLFSSL/include
      cyassllib=$OPT_WOLFSSL/lib$libsuff

      LDFLAGS="$LDFLAGS $addld"
      if test "$addcflags" != "-I/usr/include"; then
         CPPFLAGS="$CPPFLAGS $addcflags"
      fi

      cyassllibname=wolfssl
      my_ac_save_LIBS="$LIBS"
      LIBS="-l$cyassllibname -lm $LIBS"

      { $as_echo "$as_me:${as_lineno-$LINENO}: checking for CyaSSL_Init in -lwolfssl" >&5
$as_echo_n "checking for CyaSSL_Init in -lwolfssl... " >&6; }
      cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h.  */


/* These aren't needed for detection and confuse WolfSSL.
   They are set up properly later if it is detected.  */
#undef SIZEOF_LONG
#undef SIZEOF_LONG_LONG
#include <cyassl/ssl.h>

int main (void)
{

	  return CyaSSL_Init();

 ;
 return 0;
}

_ACEOF
if ac_fn_c_try_link "$LINENO"; then :

         { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
$as_echo "yes" >&6; }

$as_echo "#define USE_WOLFSSL 1" >>confdefs.h

         USE_WOLFSSL=1

         WOLFSSL_ENABLED=1
         USE_WOLFSSL="yes"
         ssl_msg="WolfSSL"
	 test cyassl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes

else

         { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
$as_echo "no" >&6; }
         CPPFLAGS=$_cppflags
         LDFLAGS=$_ldflags
         cyassllib=""

fi
rm -f core conftest.err conftest.$ac_objext \
    conftest$ac_exeext conftest.$ac_ext
      LIBS="$my_ac_save_LIBS"
    fi

    if test "x$USE_WOLFSSL" = "xyes"; then
      { $as_echo "$as_me:${as_lineno-$LINENO}: detected $cyassllibname" >&5
$as_echo "$as_me: detected $cyassllibname" >&6;}
      check_for_ca_bundle=1

            { $as_echo "$as_me:${as_lineno-$LINENO}: checking size of long long" >&5
$as_echo_n "checking size of long long... " >&6; }
if ${ac_cv_sizeof_long_long+:} false; then :
  $as_echo_n "(cached) " >&6
else

cat >>confdefs.h <<_ACEOF
#define SIZEOF_LONG_LONG $ac_cv_sizeof_long_long
_ACEOF



      LIBS="-l$cyassllibname -lm $LIBS"

                  for ac_func in wolfSSLv3_client_method \
                     wolfSSL_get_peer_certificate \
                     wolfSSL_UseALPN
do :
  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
  cat >>confdefs.h <<_ACEOF
#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF

fi
done


      if test -n "$cyassllib"; then
                                        if test "x$cross_compiling" != "xyes"; then
          CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$cyassllib"
          export CURL_LIBRARY_PATH
          { $as_echo "$as_me:${as_lineno-$LINENO}: Added $cyassllib to CURL_LIBRARY_PATH" >&5
$as_echo "$as_me: Added $cyassllib to CURL_LIBRARY_PATH" >&6;}
        fi
      fi

    fi

  fi
  test -z "$ssl_msg" || ssl_backends="${ssl_backends:+$ssl_backends, }$ssl_msg"

if test "$ipv6" = "yes"; then
  if test "$curl_cv_func_getaddrinfo" = "yes"; then

$as_echo "#define ENABLE_IPV6 1" >>confdefs.h

    IPV6_ENABLED=1


  fi
fi


            #
  tst_method="unknown"

if test "$enable_altsvc" = "yes"; then

$as_echo "#define USE_ALTSVC 1" >>confdefs.h

  experimental="$experimental alt-svc"
fi





































  { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether hiding of library internal symbols will actually happen" >&5
$as_echo_n "checking whether hiding of library internal symbols will actually happen... " >&6; }
  CFLAG_CURL_SYMBOL_HIDING=""
  doing_symbol_hiding="no"
  if test x"$curl_cv_native_windows" != "xyes" &&
    test "$want_symbol_hiding" = "yes" &&

  SUPPORT_FEATURES="$SUPPORT_FEATURES MultiSSL"
fi

if test "x$OPENSSL_ENABLED" = "x1" -o "x$GNUTLS_ENABLED" = "x1" \
    -o "x$NSS_ENABLED" = "x1"; then
  SUPPORT_FEATURES="$SUPPORT_FEATURES HTTPS-proxy"
fi







if test "x$CURL_DISABLE_HTTP" != "x1"; then
  SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS HTTP"
  if test "x$SSL_ENABLED" = "x1"; then
    SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS HTTPS"

  RTSP:             ${curl_rtsp_msg}
  RTMP:             ${curl_rtmp_msg}
  Metalink:         ${curl_mtlnk_msg}
  PSL:              ${curl_psl_msg}
  Alt-svc:          ${curl_altsvc_msg}
  HTTP2:            ${curl_h2_msg}
  HTTP3:            ${curl_h3_msg}

  Protocols:        ${SUPPORT_PROTOCOLS}
  Features:         ${SUPPORT_FEATURES}
" >&5
$as_echo "$as_me: Configured to build curl/libcurl:

  Host setup:       ${host}
  Install prefix:   ${prefix}

  RTSP:             ${curl_rtsp_msg}
  RTMP:             ${curl_rtmp_msg}
  Metalink:         ${curl_mtlnk_msg}
  PSL:              ${curl_psl_msg}
  Alt-svc:          ${curl_altsvc_msg}
  HTTP2:            ${curl_h2_msg}
  HTTP3:            ${curl_h3_msg}

  Protocols:        ${SUPPORT_PROTOCOLS}
  Features:         ${SUPPORT_FEATURES}
" >&6;}
if test -n "$experimental"; then
 cat >&2 << _EOF
  WARNING: $experimental enabled but marked EXPERIMENTAL. Use with caution!
_EOF
fi

CURL_CHECK_OPTION_OPTIMIZE
CURL_CHECK_OPTION_WARNINGS
CURL_CHECK_OPTION_WERROR
CURL_CHECK_OPTION_CURLDEBUG
CURL_CHECK_OPTION_SYMBOL_HIDING
CURL_CHECK_OPTION_ARES
CURL_CHECK_OPTION_RT


XC_CHECK_PATH_SEPARATOR

#
# save the configure arguments
#
CONFIGURE_OPTIONS="\"$ac_configure_args\""

  ipv6=yes,
  AC_MSG_RESULT(no)
  ipv6=no,
  AC_MSG_RESULT(yes)
  ipv6=yes
))

if test "$ipv6" = "yes"; then
  curl_ipv6_msg="enabled"
fi

# Check if struct sockaddr_in6 have sin6_scope_id member
if test "$ipv6" = yes; then
  AC_MSG_CHECKING([if struct sockaddr_in6 has sin6_scope_id member])
  AC_TRY_COMPILE([
#include <sys/types.h>
#ifdef HAVE_WINSOCK2_H
#include <winsock2.h>

dnl ----------------------------------------------------

dnl Default to compiler & linker defaults for wolfSSL files & libraries.
OPT_WOLFSSL=no

_cppflags=$CPPFLAGS
_ldflags=$LDFLAGS
AC_ARG_WITH(cyassl,dnl
AC_HELP_STRING([--with-cyassl=PATH],[where to look for CyaSSL, PATH points to the installation root (default: system lib default)])
AC_HELP_STRING([--without-cyassl], [disable CyaSSL detection]),
  OPT_WOLFSSL=$withval)

dnl provide --with-wolfssl as an alias for --with-cyassl
AC_ARG_WITH(wolfssl,dnl
AC_HELP_STRING([--with-wolfssl=PATH],[where to look for WolfSSL, PATH points to the installation root (default: system lib default)])
AC_HELP_STRING([--without-wolfssl], [disable WolfSSL detection]),
  OPT_WOLFSSL=$withval)

if test -z "$ssl_backends" -o "x$OPT_WOLFSSL" != xno; then
  ssl_msg=

  if test X"$OPT_WOLFSSL" != Xno; then

    if test "$OPT_WOLFSSL" = "yes"; then
      OPT_WOLFSSL=""
    fi

    dnl This should be reworked to use pkg-config instead

    cyassllibname=cyassl

    if test -z "$OPT_WOLFSSL" ; then
      dnl check for lib in system default first

      AC_CHECK_LIB(cyassl, CyaSSL_Init,
      dnl libcyassl found, set the variable
       [
         AC_DEFINE(USE_WOLFSSL, 1, [if wolfSSL is enabled])
         AC_SUBST(USE_WOLFSSL, [1])
         WOLFSSL_ENABLED=1
         USE_WOLFSSL="yes"
         ssl_msg="CyaSSL"
	 test cyassl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
        ])
    fi

    addld=""
    addlib=""
    addcflags=""
    cyassllib=""

    if test "x$USE_WOLFSSL" != "xyes"; then
      dnl add the path and test again
      addld=-L$OPT_WOLFSSL/lib$libsuff
      addcflags=-I$OPT_WOLFSSL/include
      cyassllib=$OPT_WOLFSSL/lib$libsuff

      LDFLAGS="$LDFLAGS $addld"
      if test "$addcflags" != "-I/usr/include"; then
         CPPFLAGS="$CPPFLAGS $addcflags"
      fi

      AC_CHECK_LIB(cyassl, CyaSSL_Init,
       [
       AC_DEFINE(USE_WOLFSSL, 1, [if CyaSSL is enabled])
       AC_SUBST(USE_WOLFSSL, [1])
       WOLFSSL_ENABLED=1
       USE_WOLFSSL="yes"
       ssl_msg="CyaSSL"
       test cyassl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
       ],
       [
         CPPFLAGS=$_cppflags
         LDFLAGS=$_ldflags
         cyassllib=""
       ])
    fi

    addld=""
    addlib=""
    addcflags=""

    if test "x$USE_WOLFSSL" != "xyes"; then
      dnl libcyassl renamed to libwolfssl as of 3.4.0
      addld=-L$OPT_WOLFSSL/lib$libsuff
      addcflags=-I$OPT_WOLFSSL/include
      cyassllib=$OPT_WOLFSSL/lib$libsuff

      LDFLAGS="$LDFLAGS $addld"
      if test "$addcflags" != "-I/usr/include"; then
         CPPFLAGS="$CPPFLAGS $addcflags"
      fi

      cyassllibname=wolfssl
      my_ac_save_LIBS="$LIBS"
      LIBS="-l$cyassllibname -lm $LIBS"

      AC_MSG_CHECKING([for CyaSSL_Init in -lwolfssl])
      AC_LINK_IFELSE([
	AC_LANG_PROGRAM([[
/* These aren't needed for detection and confuse WolfSSL.
   They are set up properly later if it is detected.  */
#undef SIZEOF_LONG
#undef SIZEOF_LONG_LONG
#include <cyassl/ssl.h>
	]],[[
	  return CyaSSL_Init();
	]])
      ],[
         AC_MSG_RESULT(yes)
         AC_DEFINE(USE_WOLFSSL, 1, [if wolfSSL is enabled])
         AC_SUBST(USE_WOLFSSL, [1])
         WOLFSSL_ENABLED=1
         USE_WOLFSSL="yes"
         ssl_msg="WolfSSL"
	 test cyassl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
       ],
       [
         AC_MSG_RESULT(no)
         CPPFLAGS=$_cppflags
         LDFLAGS=$_ldflags
         cyassllib=""
       ])
      LIBS="$my_ac_save_LIBS"
    fi

    if test "x$USE_WOLFSSL" = "xyes"; then
      AC_MSG_NOTICE([detected $cyassllibname])
      check_for_ca_bundle=1

      dnl cyassl/ctaocrypt/types.h needs SIZEOF_LONG_LONG defined!
      AX_COMPILE_CHECK_SIZEOF(long long)

      LIBS="-l$cyassllibname -lm $LIBS"

      dnl Recent WolfSSL versions build without SSLv3 by default
      dnl WolfSSL needs configure --enable-opensslextra to have *get_peer*
      AC_CHECK_FUNCS(wolfSSLv3_client_method \
                     wolfSSL_get_peer_certificate \
                     wolfSSL_UseALPN)

      if test -n "$cyassllib"; then
        dnl when shared libs were found in a path that the run-time
        dnl linker doesn't search through, we need to add it to
        dnl CURL_LIBRARY_PATH to prevent further configure tests to fail
        dnl due to this
        if test "x$cross_compiling" != "xyes"; then
          CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$cyassllib"
          export CURL_LIBRARY_PATH
          AC_MSG_NOTICE([Added $cyassllib to CURL_LIBRARY_PATH])
        fi
      fi

    fi

  fi dnl wolfSSL not disabled

])

if test "$ipv6" = "yes"; then
  if test "$curl_cv_func_getaddrinfo" = "yes"; then
    AC_DEFINE(ENABLE_IPV6, 1, [Define if you want to enable IPv6 support])
    IPV6_ENABLED=1
    AC_SUBST(IPV6_ENABLED)

  fi
fi

CURL_CHECK_NONBLOCKING_SOCKET

dnl ************************************************************
dnl nroff tool stuff

       AC_MSG_RESULT(no)
)

if test "$enable_altsvc" = "yes"; then
  AC_DEFINE(USE_ALTSVC, 1, [to enable alt-svc])
  experimental="$experimental alt-svc"
fi































dnl ************************************************************
dnl hiding of library internal symbols
dnl
CURL_CONFIGURE_SYMBOL_HIDING

dnl

  SUPPORT_FEATURES="$SUPPORT_FEATURES MultiSSL"
fi

if test "x$OPENSSL_ENABLED" = "x1" -o "x$GNUTLS_ENABLED" = "x1" \
    -o "x$NSS_ENABLED" = "x1"; then
  SUPPORT_FEATURES="$SUPPORT_FEATURES HTTPS-proxy"
fi





AC_SUBST(SUPPORT_FEATURES)

dnl For supported protocols in pkg-config file
if test "x$CURL_DISABLE_HTTP" != "x1"; then
  SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS HTTP"
  if test "x$SSL_ENABLED" = "x1"; then

  RTSP:             ${curl_rtsp_msg}
  RTMP:             ${curl_rtmp_msg}
  Metalink:         ${curl_mtlnk_msg}
  PSL:              ${curl_psl_msg}
  Alt-svc:          ${curl_altsvc_msg}
  HTTP2:            ${curl_h2_msg}
  HTTP3:            ${curl_h3_msg}

  Protocols:        ${SUPPORT_PROTOCOLS}
  Features:         ${SUPPORT_FEATURES}
])
if test -n "$experimental"; then
 cat >&2 << _EOF
  WARNING: $experimental enabled but marked EXPERIMENTAL. Use with caution!
_EOF
fi

[curlcpp](https://github.com/JosephP91/curlcpp) by Giuseppe Persico and [C++
Requests](https://github.com/whoshuu/cpr) by Huu Nguyen

[Ch](https://chcurl.sourceforge.io/) Written by Stephen Nestinger and Jonathan Rogado

Cocoa: [BBHTTP](https://github.com/brunodecarvalho/BBHTTP) written by Bruno de Carvalho
[curlhandle](https://github.com/karelia/curlhandle) Written by Dan Wood



[D](https://dlang.org/library/std/net/curl.html) Written by Kenneth Bogert

[Delphi](https://github.com/Mercury13/curl4delphi) Written by Mikhail Merkuryev

[Dylan](https://dylanlibs.sourceforge.io/) Written by Chris Double

[Haskell](https://hackage.haskell.org/cgi-bin/hackage-scripts/package/curl) Written by Galois, Inc

[Java](https://github.com/pjlegato/curl-java)

[Julia](https://github.com/forio/Curl.jl) Written by Paul Howe



[Lisp](https://common-lisp.net/project/cl-curl/) Written by Liam Healy

Lua: [luacurl](http://luacurl.luaforge.net/) by Alexander Marinov, [Lua-cURL](https://github.com/Lua-cURL) by Jürgen Hötzel

[Mono](https://forge.novell.com/modules/xfmod/project/?libcurl-mono) Written by Jeffrey Phillips

[.NET](https://sourceforge.net/projects/libcurl-net/) libcurl-net by Jeffrey Phillips



[node.js](https://github.com/JCMais/node-libcurl) node-libcurl by Jonathan Cardoso Machado

[Object-Pascal](https://web.archive.org/web/20020610214926/www.tekool.com/opcurl) Free Pascal, Delphi and Kylix binding written by Christophe Espern.

[OCaml](https://opam.ocaml.org/packages/ocurl/) Written by Lars Nilsson and ygrek

[Pascal](https://web.archive.org/web/20030804091414/houston.quik.com/jkp/curlpas/) Free Pascal, Delphi and Kylix binding written by Jeffrey Pohlmeyer.

Perl: [WWW--Curl](https://github.com/szbalint/WWW--Curl) Maintained by Cris
Bailiff and Bálint Szilakszi,
[perl6-net-curl](https://github.com/azawawi/perl6-net-curl) by Ahmad M. Zawawi


[PHP](https://php.net/curl) Originally written by Sterling Hughes

[PostgreSQL](https://github.com/pramsey/pgsql-http) - HTTP client for PostgreSQL



[Python](http://pycurl.io/) PycURL by Kjetil Jacobsen

[R](https://cran.r-project.org/package=curl)

[Rexx](https://rexxcurl.sourceforge.io/) Written Mark Hessling

# ngtcp2 version

## Build

Build (patched) OpenSSL

     % git clone --depth 1 -b openssl-quic-draft-22 https://github.com/tatsuhiro-t/openssl
     % cd openssl
     % ./config enable-tls1_3 --prefix=<somewhere1>
     % make
     % make install_sw

Build nghttp3

     % cd ..
     % git clone https://github.com/ngtcp2/nghttp3
     % cd nghttp3
     % autoreconf -i
     % ./configure --prefix=<somewhere2> --enable-lib-only
     % make
     % make install

Build ngtcp2

     % cd ..
     % git clone -b draft-22 https://github.com/ngtcp2/ngtcp2
     % cd ngtcp2
     % autoreconf -i
     % ./configure PKG_CONFIG_PATH=<somewhere1>/lib/pkgconfig:<somewhere2>/lib/pkgconfig LDFLAGS="-Wl,-rpath,<somehere1>/lib" --prefix==<somewhere3>
     % make
     % make install

Build curl

     % cd ..
     % git clone https://github.com/curl/curl
     % cd curl
     % ./buildconf
     % LDFLAGS="-Wl,-rpath,<somewhere1>/lib" ./configure -with-ssl=<somewhere1> --with-nghttp3=<somewhere2> --with-ngtcp2=<somewhere3>
     % make

## Running

Make sure the custom OpenSSL library is the one used at run-time, as otherwise
you'll just get ld.so linker errors.

## Invoke from command line

    curl --http3 https://nghttp2.org:8443/

# quiche version

## build

Clone quiche and BoringSSL:

     % git clone --recursive https://github.com/cloudflare/quiche

Build BoringSSL (it needs to be built manually so it can be reused with curl):

     % cd quiche/deps/boringssl
     % mkdir build
     % cd build
     % cmake -DCMAKE_POSITION_INDEPENDENT_CODE=on ..
     % make -j`nproc`
     % cd ..
     % mkdir .openssl/lib -p
     % cp build/crypto/libcrypto.a build/ssl/libssl.a .openssl/lib
     % ln -s $PWD/include .openssl

Build quiche:

     % cd ../..
     % QUICHE_BSSL_PATH=$PWD/deps/boringssl cargo build --release --features pkg-config-meta

Clone and build curl:

     % cd ..
     % git clone https://github.com/curl/curl
     % cd curl
     % ./buildconf
     % ./configure LDFLAGS="-Wl,-rpath,$PWD/../quiche/target/release" --with-ssl=$PWD/../quiche/deps/boringssl/.openssl --with-quiche=$PWD/../quiche/target/release
     % make -j`nproc`

## Running

Make an HTTP/3 request.

     % src/curl --http3 https://cloudflare-quic.com/
     % src/curl --http3 https://facebook.com/


     % src/curl --http3 https://quic.aiortc.org:4433/
     % src/curl --http3 https://quic.rocks:4433/

# how to install curl and libcurl

## Installing Binary Packages

Lots of people download binary distributions of curl and libcurl. This
document does not describe how to install curl or libcurl using such a binary
package. This document describes how to compile, build and install curl and
libcurl from source code.













## Building from git

If you get your code off a git repository instead of a release tarball, see
the `GIT-INFO` file in the root directory for specific instructions on how to
proceed.

# Unix

If you have OpenSSL installed somewhere else (for example, `/opt/OpenSSL`) and
you have pkg-config installed, set the pkg-config path first, like this:

    env PKG_CONFIG_PATH=/opt/OpenSSL/lib/pkgconfig ./configure --with-ssl

Without pkg-config installed, use this:

   ./configure --with-ssl=/opt/OpenSSL

If you insist on forcing a build without SSL support, even though you may
have OpenSSL installed in your system, you can run configure like this:

   ./configure --without-ssl

If you have OpenSSL installed, but with the libraries in one place and the
header files somewhere else, you have to set the `LDFLAGS` and `CPPFLAGS`
environment variables prior to running configure.  Something like this should
work:

    CPPFLAGS="-I/path/to/ssl/include" LDFLAGS="-L/path/to/ssl/lib" ./configure

These are problems and bugs known to exist at the time of this release. Feel
free to join in and help us correct one or more of these! Also be sure to
check the changelog of the current development status, as one or more of these
problems may have been fixed or changed somewhat since this was written!

 1. HTTP
 1.1 CURLFORM_CONTENTLEN in an array
 1.3 STARTTRANSFER time is wrong for HTTP POSTs
 1.4 multipart formposts file name encoding
 1.5 Expect-100 meets 417
 1.6 Unnecessary close when 401 received waiting for 100
 1.7 Deflate error after all content was received
 1.8 DoH isn't used for all name resolves when enabled
 1.9 HTTP/2 frames while in the connection pool kill reuse

 5.3 curl compiled on OSX 10.13 failed to run on OSX 10.10
 5.4 Cannot compile against a static build of OpenLDAP
 5.5 can't handle Unicode arguments in Windows
 5.6 cmake support gaps
 5.7 Visual Studio project gaps
 5.8 configure finding libs in wrong directory
 5.9 Utilize Requires.private directives in libcurl.pc


 6. Authentication
 6.1 NTLM authentication and unicode
 6.2 MIT Kerberos for Windows build
 6.3 NTLM in system context uses wrong name
 6.4 Negotiate and Kerberos V5 need a fake user name
 6.5 NTLM doesn't support password with § character

 11.4 HTTP test server 'connection-monitor' problems
 11.5 Connection information when using TCP Fast Open
 11.6 slow connect to localhost on Windows
 11.7 signal-based resolver timeouts

 12. LDAP and OpenLDAP
 12.1 OpenLDAP hangs after returning results


 13. TCP/IP
 13.1 --interface for ipv6 binds to unusable IP address

 14 DICT
 14.1 DICT responses show the underlying protocol

==============================================================================

1. HTTP

1.1 CURLFORM_CONTENTLEN in an array

 It is not possible to pass a 64-bit value using CURLFORM_CONTENTLEN with
 CURLFORM_ARRAY, when compiled on 32-bit platforms that support 64-bit
 integers. This is because the underlying structure 'curl_forms' uses a dual
 purpose char* for storing these values in via casting. For more information
 see the now closed related issue:
 https://github.com/curl/curl/issues/608

1.3 STARTTRANSFER time is wrong for HTTP POSTs

 Wrong STARTTRANSFER timer accounting for POST requests Timer works fine with
 GET requests, but while using POST the time for CURLINFO_STARTTRANSFER_TIME
 is wrong. While using POST CURLINFO_STARTTRANSFER_TIME minus
 CURLINFO_PRETRANSFER_TIME is near to zero every time.

 separate variable that only after all library checks have been performed gets
 appended to LDFLAGS.

5.9 Utilize Requires.private directives in libcurl.pc

 https://github.com/curl/curl/issues/864








6. Authentication

6.1 NTLM authentication and unicode

 NTLM authentication involving unicode user name or password only works
 properly if built with UNICODE defined together with the WinSSL/Schannel
 backend. The original problem was mentioned in:

 descriptors for a single easy handle (currently limited to 5).

 Generic LDAP is synchronous: OK.

 See https://github.com/curl/curl/issues/622 and
     https://curl.haxx.se/mail/lib-2016-01/0101.html





13. TCP/IP

13.1 --interface for ipv6 binds to unusable IP address

 Since IPv6 provides a lot of addresses with different scope, binding to an
 IPv6 address needs to take the proper care so that it doesn't bind to a

 CHECKSRC.md                                    \
 CIPHERS.md                                     \
 CMakeLists.txt                                 \
 CODE_OF_CONDUCT.md                             \
 CODE_STYLE.md                                  \
 CONTRIBUTE.md                                  \
 DEPRECATE.md                                   \

 EXPERIMENTAL.md                                \
 FAQ                                            \
 FEATURES                                       \
 GOVERNANCE.md                                  \
 HELP-US.md                                     \
 HISTORY.md                                     \
 HTTP-COOKIES.md                                \

 CHECKSRC.md                                    \
 CIPHERS.md                                     \
 CMakeLists.txt                                 \
 CODE_OF_CONDUCT.md                             \
 CODE_STYLE.md                                  \
 CONTRIBUTE.md                                  \
 DEPRECATE.md                                   \

 EXPERIMENTAL.md                                \
 FAQ                                            \
 FEATURES                                       \
 GOVERNANCE.md                                  \
 HELP-US.md                                     \
 HISTORY.md                                     \
 HTTP-COOKIES.md                                \

Alessandro Vesely
Alex Baines
Alex Bligh
Alex Chan
Alex Fishman
Alex Grebenschikov
Alex Gruz

Alex Malinovich
Alex Mayorga
Alex McLellan
Alex Neblett
Alex Nichols
Alex Potapenko
Alex Rousskov

Alex Suykov
Alex Vinnik
Alex aka WindEagle
Alexander Beedie
Alexander Dyagilev
Alexander Elgert
Alexander Klauer

Andreas Wurf
Andrei Benea
Andrei Cipu
Andrei Karas
Andrei Kurushin
Andrei Neculau
Andrei Sedoi

Andrei Virtosu
Andrej E Baranov
Andrew Benham
Andrew Biggs
Andrew Bushnell
Andrew Francis
Andrew Fuller

Ayoub Boudhar
Balaji Parasuram
Balaji S Rao
Balaji Salunke
Balazs Kovacsics
Balint Szilakszi
Barry Abrahamson

Bart Whiteley
Bas Mevissen
Bas van Schaik

Basuke Suzuki
Ben Boeckel
Ben Darnell
Ben Greear
Ben Kohler
Ben Madsen
Ben Noordhuis

Bruce Mitchener
Bruce Stephens
Bruno Grasselli
Bruno Thomsen
Bruno de Carvalho
Bryan Henderson
Bryan Kemp

Byrial Jensen
Caleb Raitto
Cameron Kaiser
Cameron MacMinn
Camille Moncelier
Caolan McNamara
Carie Pointer

Christian Krause
Christian Kurz
Christian Robottom Reis
Christian Schmitz
Christian Stewart
Christian Vogt
Christian Weisgerber

Christophe Demory

Christophe Legry
Christopher Conroy
Christopher Head
Christopher Palow
Christopher R. Palmer
Christopher Stone
Chungtsun Li

Daniel Lublin
Daniel Melani
Daniel Mentz
Daniel Romero
Daniel Schauenberg
Daniel Seither
Daniel Shahaf

Daniel Steinberg
Daniel Stenberg
Daniel Theron
Daniel at touchtunes
Daphne Luong
Dario Nieuwenhuis
Dario Weißer

David Tarendash
David Thiel
David Walser
David Woodhouse
David Wright
David Yan
Dengminwen

Denis Feklushkin
Denis Ollier
Dennis Clarke
Derek Higgins
Desmond O. Chang
Detlef Schmier
Dheeraj Sangamkar

Eldar Zaitov
Eli Schwartz
Elia Tufarolo
Elliot Saba
Ellis Pritchard
Elmira A Semenova
Emanuele Bovisio

Emil Lerner
Emil Romanus
Emiliano Ida
Emmanuel Tychon
Enrico Scholz
Enrik Berkhan
Eramoto Masaya

Florian Schoppmann
Florian Weimer
Florin Petriuc
Forrest Cahoon
Francisco Moraes
Francisco Sedano
Francois Petitjean

Frank Denis
Frank Gevaerts
Frank Hempel
Frank Keeney
Frank McGeough
Frank Meier
Frank Ticheler

Gaël Portay
Geeknik Labs
Geoff Beier
Georg Horn
Georg Huettenegger
Georg Lippitsch
Georg Wicherski

Gerd v. Egidy
Gergely Nagy
Gerhard Herre
Gerrit Bruchhäuser
Ghennadi Procopciuc
Giancarlo Formicuccia
Giaslas Georgios
Gil Weber
Gilad
Gilbert Ramirez Jr.
Gilles Blanc

Giorgos Oikonomou
Gisle Vanem
GitYuanQu on github
Giuseppe Attardi
Giuseppe D'Ambrosio
Giuseppe Persico
Glen A Johnson Jr.

Greg Morse
Greg Onufer
Greg Pratt
Greg Rowe
Greg Zavertnik
Gregory Nicholls
Gregory Szorc

Grigory Entin
Guenole Bescon
Guido Berhoerster
Guillaume Arluison
Gunter Knauf
Gustaf Hui
Gustavo Grieco

Igor Makarov
Igor Novoseltsev
Igor Polyakov
Ihor Karpenko
Iida Yosiaki
Ilguiz Latypov
Ilja van Sprundel

Immanuel Gregoire
Inca R
Ingmar Runge
Ingo Ralf Blum
Ingo Wilken
Irfan Adilovic
Ironbars13 on github
Irving Wolfe
Isaac Boukris
Isaiah Norton
Ishan SinghLevett
Ithubg on github
Ivan Avdeev
Ivo Bellin Salarin
Jack Zhang
Jackarain on github
Jacky Lam

Jacob Meuser
Jacob Moshenko
Jactry Zeng
Jad Chamcham
Jaime Fullaondo
Jakub Wilk
Jakub Zakrzewski

Jeff Johnson
Jeff King
Jeff Lawson
Jeff Phillips
Jeff Pohlmeyer
Jeff Weber
Jeffrey Walton

Jens Rantil
Jens Schleusener
Jeremie Rapin
Jeremy Friesner
Jeremy Huddleston
Jeremy Lainé
Jeremy Lin

Jesse Tan
Jie He
Jim Drash
Jim Freeman
Jim Fuller
Jim Hollinger
Jim Meyering

Jiri Dvorak
Jiri Hruska
Jiri Jaburek
Jiří Malák
Jocelyn Jaubert
Joe Halpin
Joe Malicki

John Suprock
John V. Chow
John Wanghui
John Weismiller
John Wilkinson
John-Mark Bell
Johnny Luong

Jon DeVree
Jon Grubbs
Jon Nelson
Jon Sargeant
Jon Seymour
Jon Spencer
Jon Torrey

Loic Dachary
Loren Kirkby
Luan Cestari
Luca Altea
Luca Boccassi
Lucas Adamski
Lucas Pardue

Ludek Finstrle
Ludovico Cavedon
Ludwig Nussel
Lukas Ruzicka
Lukasz Czekierda
Luke Amery
Luke Call

Marc Doughty
Marc Hesse
Marc Hörsken
Marc Kleine-Budde
Marc Renault
Marc Schlatter
Marc-Antoine Perennou

Marcel Raad
Marcel Roelofs
Marcelo Echeverria
Marcelo Juchem
Marcin Adamski
Marcin Gryszkalis
Marcin Konicki

Martijn Koster
Martin Ankerl
Martin C. Martin
Martin Drasar
Martin Dreher
Martin Frodl
Martin Galvan

Martin Hager
Martin Hedenfalk
Martin Jansen
Martin Kammerhofer
Martin Kepplinger
Martin Lemke
Martin Skinner

NTMan on Github
Nach M. S.
Nagai H
Nate Prewitt
Nathan Coulter
Nathan O'Sullivan
Nathanael Nerode

Nathaniel Waisbrot
Naveen Chandran
Naveen Noel
Neal Poole
Nehal J Wani
Neil Bowers
Neil Dunbar
Neil Kolban
Neil Spring

Nic Roets
Nicholas Maniscalco
Nick Draffen
Nick Gimbrone
Nick Humfrey
Nick Miyake
Nick Zitzmann

Patrick Rapin
Patrick Schlangen
Patrick Scott
Patrick Smith
Patrick Watson
Patrik Thunstrom
Pau Garcia i Quiles

Paul Donohue

Paul Groke
Paul Harrington
Paul Harris
Paul Howarth
Paul Joyce
Paul Marks
Paul Marquis

Peter Laser
Peter O'Gorman
Peter Pentchev
Peter Piekarski
Peter Silva
Peter Simonyi
Peter Su

Peter Sylvester
Peter Todd
Peter Varga
Peter Verhas
Peter Wang
Peter Wu
Peter Wullinger

Phil Pellouchoud
Philip Craig
Philip Gladstone
Philip Langdale
Philip Prindeville
Philipp Waehnert
Philippe Hameau

Philippe Raoult
Philippe Vaucher
Pierre
Pierre Brico
Pierre Chapuis
Pierre Joye
Pierre Ynard
Piotr Dobrogost

Po-Chuan Hsieh
Pooyan McSporran
Poul T Lomholt
Pramod Sharma
Prash Dush
Praveen Pvs
Priyanka Shah

Rod Widdowson
Rodger Combs
Rodney Simmons
Rodric Glaser
Rodrigo Silva
Roger Leigh
Roland Blom

Roland Krikava
Roland Zimmermann
Rolf Eike Beer
Rolland Dudemaine
Romain Coltel
Romain Fliedel
Romain Geissler

Scott Davis
Scott McCreary
Sean Boudreau
Sean Burford
Sean MacLennan
Sean Miller
Sebastiaan van Erk

Sebastian Mundry
Sebastian Pohlschmidt
Sebastian Rasmussen
Senthil Raja Velu
Sergei Kuzmin
Sergei Nikulov
Sergey Ogryzkov

Simon Legner
Simon Liu
Simon Warta
Somnath Kundu
Song Ma
Sonia Subramanian
Spacen Jasset

Spiridonoff A.V
Spork Schivago
Stadler Stephan
Stan van de Burgt
Stanislav Ivochkin
Stanislav Zidek
Stefan Agner

Steve Roskowski
Steve Walch
Steven Bazyl
Steven G. Johnson
Steven Gu
Steven M. Schweda
Steven Parkes

Stoned Elipot
Stuart Henderson

Sune Ahlgren
Sunny Purushe
Sven Anders
Sven Blumenstein
Sven Neuhaus
Sven Wegener
Svyatoslav Mishyn

Torben Dannhauer
Torsten Foertsch
Toshio Kuratomi
Toshiyuki Maezawa
Traian Nicolescu
Travis Burtrum
Travis Obenhaus

Troels Walsted Hansen
Troy Engel
Tseng Jun
Tuomo Rinne
Tupone Alfredo
Tyler Hall
Török Edwin
Ulf Härnhammar
Ulf Samuelsson
Ulrich Doehner
Ulrich Telle
Ulrich Zadow
Valentin David

Vasiliy Faronov
Vasily Lobaskin
Vasy Okhin
Venkat Akella
Venkataramana Mokkapati
Vicente Garcia
Victor Snezhko
Vijay Panghal
Vikram Saxena
Viktor Szakats

Ville Skyttä
Vilmos Nebehaj
Vincas Razma
Vincent Bronner
Vincent Le Normand
Vincent Penquerc'h
Vincent Sanders

Xiangbin Li
XmiliaH on github
Yaakov Selkowitz
Yang Tse
Yarram Sunil
Yasuharu Yamada
Yasuhiro Matsumoto

Yehezkel Horowitz
Yehoshua Hershberg
Yi Huang
Yiming Jing
Yingwei Liu
Yonggang Luo
Yousuke Kimoto

jakirkham on github
jasal82 on github
jnbr on github
jonrumsey on github
joshhe on github
jungle-boogie on github
jveazey on github

ka7 on github
kreshano on github
l00p3r on Hackerone
lijian996 on github
lukaszgn on github
madblobfish on github
marc-groundctl on github
masbug on github
mccormickt12 on github
migueljcrum on github
mkzero on github

moohoorama on github
nedres on github
neex on github
neheb on github
nevv on HackerOne/curl
niallor on github
nianxuejie on github

niner on github
nk
nopjmp on github
olesteban on github
omau on github
osabc on github
ovidiu-benea on github

 consider bringing it up for discussions first on the mailing list so that we
 all agree it is still a good idea for the project!

 All bugs documented in the KNOWN_BUGS document are subject for fixing!

 1. libcurl
 1.1 TFO support on Windows

 1.3 struct lifreq
 1.5 get rid of PATH_MAX
 1.7 Support HTTP/2 for HTTP(S) proxies
 1.8 CURLOPT_RESOLVE for any port number
 1.9 Cache negative name resolves
 1.10 auto-detect proxy
 1.11 minimize dependencies with dynamically loaded modules

 16. SASL
 16.1 Other authentication mechanisms
 16.2 Add QOP support to GSSAPI authentication
 16.3 Support binary messages (i.e.: non-base64)

 17. SSH protocols
 17.1 Multiplexing

 17.3 Support better than MD5 hostkey hash
 17.4 Support CURLOPT_PREQUOTE

 18. Command line tool
 18.1 sync
 18.2 glob posts
 18.3 prevent file overwriting

1.1 TFO support on Windows

 TCP Fast Open is supported on several platforms but not on Windows. Work on
 this was once started but never finished.

 See https://github.com/curl/curl/pull/3378







1.3 struct lifreq

 Use 'struct lifreq' and SIOCGLIFADDR instead of 'struct ifreq' and
 SIOCGIFADDR on newer Solaris versions as they claim the latter is obsolete.
 To support IPv6 interface addresses for network interfaces properly.

1.5 get rid of PATH_MAX

 much in the same spirit as HTTP/2 does. libcurl however does not take
 advantage of that ability but will instead always create a new connection for
 new transfers even if an existing connection already exists to the host.

 To fix this, libcurl would have to detect an existing connection and "attach"
 the new transfer to the existing one.











17.3 Support better than MD5 hostkey hash

 libcurl offers the CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 option for verifying the
 server's key. MD5 is generally being deprecated so we should implement
 support for stronger hashing algorithms. libssh2 itself is what provides this
 underlying functionality and it supports at least SHA-1 as an alternative.
 SHA-1 is also being deprecated these days so we should consider working with

  netrc-file.d					\
  netrc-optional.d				\
  netrc.d					\
  next.d no-alpn.d				\
  no-buffer.d					\
  no-keepalive.d				\
  no-npn.d					\

  no-sessionid.d				\
  noproxy.d					\
  ntlm.d ntlm-wb.d				\
  oauth2-bearer.d				\
  output.d                                      \
  pass.d                			\
  parallel.d                                    \

  parallel-max.d                                \
  path-as-is.d					\
  pinnedpubkey.d				\
  post301.d					\
  post302.d					\
  post303.d					\
  preproxy.d					\

  netrc-file.d					\
  netrc-optional.d				\
  netrc.d					\
  next.d no-alpn.d				\
  no-buffer.d					\
  no-keepalive.d				\
  no-npn.d					\

  no-sessionid.d				\
  noproxy.d					\
  ntlm.d ntlm-wb.d				\
  oauth2-bearer.d				\
  output.d                                      \
  pass.d                			\
  parallel.d                                    \

  parallel-max.d                                \
  path-as-is.d					\
  pinnedpubkey.d				\
  post301.d					\
  post302.d					\
  post303.d					\
  preproxy.d					\

.\" * furnished to do so, under the terms of the COPYING file.
.\" *
.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
.\" * KIND, either express or implied.
.\" *
.\" **************************************************************************
.\"
.TH curl-config 1 "November 30, 2017" "Curl 7.66.0" "curl-config manual"

.SH NAME
curl-config \- Get information about a libcurl installation
.SH SYNOPSIS
.B curl-config [options]
.SH DESCRIPTION
.B curl-config

.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
.\" * KIND, either express or implied.
.\" *
.\" **************************************************************************
.\"
.\" DO NOT EDIT. Generated by the curl project gen.pl man page generator.
.\"
.TH curl 1 "November 16, 2016" "Curl 7.66.0" "Curl Manual"

.SH NAME
curl \- transfer a URL
.SH SYNOPSIS
.B curl [options / URLs]
.SH DESCRIPTION
.B curl

--keepalive to enforce keepalive.
.IP "--no-npn"
(HTTPS) Disable the NPN TLS extension. NPN is enabled by default if libcurl was built
with an SSL library that supports NPN. NPN is used by a libcurl that supports
HTTP/2 to negotiate HTTP/2 support with the server during https sessions.

See also \fI--no-alpn\fP and \fI--http2\fP. \fI--no-npn\fP requires that the underlying libcurl was built to support TLS. Added in 7.36.0.








.IP "--no-sessionid"
(TLS) Disable curl's use of SSL session-ID caching.  By default all transfers are
done using the cache. Note that while nothing should ever get hurt by
attempting to reuse SSL session-IDs, there seem to be broken SSL
implementations in the wild that may require you to disable this in order for
you to succeed.

# These examples require external dependencies that may not be commonly
# available on POSIX systems, so don't bother attempting to compile them here.
COMPLICATED_EXAMPLES = curlgtk.c curlx.c htmltitle.cpp cacertinmem.c \
  ghiper.c hiperfifo.c htmltidy.c multithread.c opensslthreadlock.c \
  sampleconv.c synctime.c threaded-ssl.c evhiperfifo.c \
  smooth-gtk-thread.c version-check.pl href_extractor.c asiohiper.cpp \
  multi-uv.c xmlstream.c usercertinmem.c sessioninfo.c \
  threaded-shared-conn.c crawler.c ephiperfifo.c

CHECKSRC = $(CS_$(V))
CS_0 = @echo "  RUN     " $@;
CS_1 = 
CS_ = $(CS_0)
all: all-am

# These examples require external dependencies that may not be commonly
# available on POSIX systems, so don't bother attempting to compile them here.
COMPLICATED_EXAMPLES = curlgtk.c curlx.c htmltitle.cpp cacertinmem.c \
  ghiper.c hiperfifo.c htmltidy.c multithread.c opensslthreadlock.c \
  sampleconv.c synctime.c threaded-ssl.c evhiperfifo.c \
  smooth-gtk-thread.c version-check.pl href_extractor.c asiohiper.cpp \
  multi-uv.c xmlstream.c usercertinmem.c sessioninfo.c \
  threaded-shared-conn.c crawler.c ephiperfifo.c

/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
 * are also available at https://curl.haxx.se/docs/copyright.html.
 *
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 * copies of the Software, and permit persons to whom the Software is

/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
 * are also available at https://curl.haxx.se/docs/copyright.html.
 *
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 * copies of the Software, and permit persons to whom the Software is

/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
 * are also available at https://curl.haxx.se/docs/copyright.html.
 *
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 * copies of the Software, and permit persons to whom the Software is

/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
 * are also available at https://curl.haxx.se/docs/copyright.html.
 *
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 * copies of the Software, and permit persons to whom the Software is

/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
 * are also available at https://curl.haxx.se/docs/copyright.html.
 *
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 * copies of the Software, and permit persons to whom the Software is

/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
 * are also available at https://curl.haxx.se/docs/copyright.html.
 *
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 * copies of the Software, and permit persons to whom the Software is

/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
 * are also available at https://curl.haxx.se/docs/copyright.html.
 *
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 * copies of the Software, and permit persons to whom the Software is

/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
 * are also available at https://curl.haxx.se/docs/copyright.html.
 *
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 * copies of the Software, and permit persons to whom the Software is