TODO 49 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372
  1. _ _ ____ _
  2. ___| | | | _ \| |
  3. / __| | | | |_) | |
  4. | (__| |_| | _ <| |___
  5. \___|\___/|_| \_\_____|
  6. Things that could be nice to do in the future
  7. Things to do in project curl. Please tell us what you think, contribute and
  8. send us patches that improve things.
  9. Be aware that these are things that we could do, or have once been considered
  10. things we could do. If you want to work on any of these areas, please
  11. consider bringing it up for discussions first on the mailing list so that we
  12. all agree it is still a good idea for the project.
  13. All bugs documented in the KNOWN_BUGS document are subject for fixing.
  14. 1. libcurl
  15. 1.1 TFO support on Windows
  16. 1.2 Consult %APPDATA% also for .netrc
  17. 1.3 struct lifreq
  18. 1.4 alt-svc sharing
  19. 1.5 get rid of PATH_MAX
  20. 1.6 thread-safe sharing
  21. 1.8 CURLOPT_RESOLVE for any port number
  22. 1.9 Cache negative name resolves
  23. 1.10 auto-detect proxy
  24. 1.11 minimize dependencies with dynamically loaded modules
  25. 1.12 updated DNS server while running
  26. 1.13 c-ares and CURLOPT_OPENSOCKETFUNCTION
  27. 1.14 connect to multiple IPs in parallel
  28. 1.15 Monitor connections in the connection pool
  29. 1.16 Try to URL encode given URL
  30. 1.17 Add support for IRIs
  31. 1.18 try next proxy if one does not work
  32. 1.19 provide timing info for each redirect
  33. 1.20 SRV and URI DNS records
  34. 1.21 netrc caching and sharing
  35. 1.22 CURLINFO_PAUSE_STATE
  36. 1.23 Offer API to flush the connection pool
  37. 1.25 Expose tried IP addresses that failed
  38. 1.28 FD_CLOEXEC
  39. 1.29 WebSocket read callback
  40. 1.30 config file parsing
  41. 1.31 erase secrets from heap/stack after use
  42. 1.32 add asynch getaddrinfo support
  43. 1.33 make DoH inherit more transfer properties
  44. 2. libcurl - multi interface
  45. 2.1 More non-blocking
  46. 2.2 Better support for same name resolves
  47. 2.3 Non-blocking curl_multi_remove_handle()
  48. 2.4 Split connect and authentication process
  49. 2.5 Edge-triggered sockets should work
  50. 2.6 multi upkeep
  51. 2.7 Virtual external sockets
  52. 2.8 dynamically decide to use socketpair
  53. 3. Documentation
  54. 3.1 Improve documentation about fork safety
  55. 3.2 Provide cmake config-file
  56. 4. FTP
  57. 4.1 HOST
  58. 4.4 Support CURLOPT_PREQUOTE for directories listings
  59. 4.6 GSSAPI via Windows SSPI
  60. 4.7 STAT for LIST without data connection
  61. 4.8 Passive transfer could try other IP addresses
  62. 5. HTTP
  63. 5.1 Provide the error body from a CONNECT response
  64. 5.2 Obey Retry-After in redirects
  65. 5.3 Rearrange request header order
  66. 5.4 Allow SAN names in HTTP/2 server push
  67. 5.5 auth= in URLs
  68. 5.6 alt-svc should fallback if alt-svc does not work
  69. 5.7 Require HTTP version X or higher
  70. 6. TELNET
  71. 6.1 ditch stdin
  72. 6.2 ditch telnet-specific select
  73. 6.3 feature negotiation debug data
  74. 6.4 exit immediately upon connection if stdin is /dev/null
  75. 7. SMTP
  76. 7.1 Passing NOTIFY option to CURLOPT_MAIL_RCPT
  77. 7.2 Enhanced capability support
  78. 7.3 Add CURLOPT_MAIL_CLIENT option
  79. 8. POP3
  80. 8.2 Enhanced capability support
  81. 9. IMAP
  82. 9.1 Enhanced capability support
  83. 10. LDAP
  84. 10.1 SASL based authentication mechanisms
  85. 10.2 CURLOPT_SSL_CTX_FUNCTION for LDAPS
  86. 10.3 Paged searches on LDAP server
  87. 10.4 Certificate-Based Authentication
  88. 11. SMB
  89. 11.1 File listing support
  90. 11.2 Honor file timestamps
  91. 11.3 Use NTLMv2
  92. 11.4 Create remote directories
  93. 12. FILE
  94. 12.1 Directory listing on non-POSIX
  95. 13. TLS
  96. 13.1 TLS-PSK with OpenSSL
  97. 13.2 TLS channel binding
  98. 13.3 Defeat TLS fingerprinting
  99. 13.5 Export session ids
  100. 13.6 Provide callback for cert verification
  101. 13.7 Less memory massaging with Schannel
  102. 13.8 Support DANE
  103. 13.9 TLS record padding
  104. 13.10 Support Authority Information Access certificate extension (AIA)
  105. 13.11 Some TLS options are not offered for HTTPS proxies
  106. 13.13 Make sure we forbid TLS 1.3 post-handshake authentication
  107. 13.14 Support the clienthello extension
  108. 13.15 Select signature algorithms
  109. 13.16 Share the CA cache
  110. 13.17 Add missing features to TLS backends
  111. 15. Schannel
  112. 15.1 Extend support for client certificate authentication
  113. 15.2 Extend support for the --ciphers option
  114. 15.4 Add option to allow abrupt server closure
  115. 16. SASL
  116. 16.1 Other authentication mechanisms
  117. 16.2 Add QOP support to GSSAPI authentication
  118. 17. SSH protocols
  119. 17.1 Multiplexing
  120. 17.2 Handle growing SFTP files
  121. 17.3 Read keys from ~/.ssh/id_ecdsa, id_ed25519
  122. 17.4 Support CURLOPT_PREQUOTE
  123. 17.5 SSH over HTTPS proxy with more backends
  124. 17.6 SFTP with SCP://
  125. 18. Command line tool
  126. 18.1 sync
  127. 18.2 glob posts
  128. 18.4 --proxycommand
  129. 18.5 UTF-8 filenames in Content-Disposition
  130. 18.6 Option to make -Z merge lined based outputs on stdout
  131. 18.7 specify which response codes that make -f/--fail return error
  132. 18.9 Choose the name of file in braces for complex URLs
  133. 18.10 improve how curl works in a Windows console window
  134. 18.11 Windows: set attribute 'archive' for completed downloads
  135. 18.12 keep running, read instructions from pipe/socket
  136. 18.13 Acknowledge Ratelimit headers
  137. 18.14 --dry-run
  138. 18.15 --retry should resume
  139. 18.16 send only part of --data
  140. 18.17 consider filename from the redirected URL with -O ?
  141. 18.18 retry on network is unreachable
  142. 18.19 expand ~/ in config files
  143. 18.20 hostname sections in config files
  144. 18.21 retry on the redirected-to URL
  145. 18.23 Set the modification date on an uploaded file
  146. 18.24 Use multiple parallel transfers for a single download
  147. 18.25 Prevent terminal injection when writing to terminal
  148. 18.26 Custom progress meter update interval
  149. 18.27 -J and -O with %-encoded filenames
  150. 18.28 -J with -C -
  151. 18.29 --retry and transfer timeouts
  152. 19. Build
  153. 19.2 Enable PIE and RELRO by default
  154. 19.3 Do not use GNU libtool on OpenBSD
  155. 19.4 Package curl for Windows in a signed installer
  156. 19.5 make configure use --cache-file more and better
  157. 20. Test suite
  158. 20.1 SSL tunnel
  159. 20.2 nicer lacking perl message
  160. 20.3 more protocols supported
  161. 20.4 more platforms supported
  162. 20.6 Use the RFC 6265 test suite
  163. 20.8 Run web-platform-tests URL tests
  164. 21. MQTT
  165. 21.1 Support rate-limiting
  166. 21.2 Support MQTTS
  167. 21.3 Handle network blocks
  168. 22. TFTP
  169. 22.1 TFTP does not convert LF to CRLF for mode=netascii
  170. 23. Gopher
  171. 23.1 Handle network blocks
  172. ==============================================================================
  173. 1. libcurl
  174. 1.1 TFO support on Windows
  175. libcurl supports the CURLOPT_TCP_FASTOPEN option since 7.49.0 for Linux and
  176. macOS. Windows supports TCP Fast Open starting with Windows 10, version 1607
  177. and we should add support for it.
  178. TCP Fast Open is supported on several platforms but not on Windows. Work on
  179. this was once started but never finished.
  180. See https://github.com/curl/curl/pull/3378
  181. 1.2 Consult %APPDATA% also for .netrc
  182. %APPDATA%\.netrc is not considered when running on Windows. should not it?
  183. See https://github.com/curl/curl/issues/4016
  184. 1.3 struct lifreq
  185. Use 'struct lifreq' and SIOCGLIFADDR instead of 'struct ifreq' and
  186. SIOCGIFADDR on newer Solaris versions as they claim the latter is obsolete.
  187. To support IPv6 interface addresses for network interfaces properly.
  188. 1.4 alt-svc sharing
  189. The share interface could benefit from allowing the alt-svc cache to be
  190. possible to share between easy handles.
  191. See https://github.com/curl/curl/issues/4476
  192. The share interface offers CURL_LOCK_DATA_CONNECT to have multiple easy
  193. handle share a connection cache, but due to how connections are used they are
  194. still not thread-safe when used shared.
  195. See https://github.com/curl/curl/issues/4915 and lib1541.c
  196. The share interface offers CURL_LOCK_DATA_HSTS to have multiple easy handle
  197. share a HSTS cache, but this is not thread-safe.
  198. 1.5 get rid of PATH_MAX
  199. Having code use and rely on PATH_MAX is not nice:
  200. https://insanecoding.blogspot.com/2007/11/pathmax-simply-isnt.html
  201. Currently the libssh2 SSH based code uses it, but to remove PATH_MAX from
  202. there we need libssh2 to properly tell us when we pass in a too small buffer
  203. and its current API (as of libssh2 1.2.7) does not.
  204. 1.6 thread-safe sharing
  205. Using the share interface users can share some data between easy handles but
  206. several of the sharing options are documented as not safe and supported to
  207. share between multiple concurrent threads. Fixing this would enable more
  208. users to share data in more powerful ways.
  209. 1.8 CURLOPT_RESOLVE for any port number
  210. This option allows applications to set a replacement IP address for a given
  211. host + port pair. Consider making support for providing a replacement address
  212. for the hostname on all port numbers.
  213. See https://github.com/curl/curl/issues/1264
  214. 1.9 Cache negative name resolves
  215. A name resolve that has failed is likely to fail when made again within a
  216. short period of time. Currently we only cache positive responses.
  217. 1.10 auto-detect proxy
  218. libcurl could be made to detect the system proxy setup automatically and use
  219. that. On Windows, macOS and Linux desktops for example.
  220. The pull-request to use libproxy for this was deferred due to doubts on the
  221. reliability of the dependency and how to use it:
  222. https://github.com/curl/curl/pull/977
  223. libdetectproxy is a (C++) library for detecting the proxy on Windows
  224. https://github.com/paulharris/libdetectproxy
  225. 1.11 minimize dependencies with dynamically loaded modules
  226. We can create a system with loadable modules/plug-ins, where these modules
  227. would be the ones that link to 3rd party libs. That would allow us to avoid
  228. having to load ALL dependencies since only the necessary ones for this
  229. app/invoke/used protocols would be necessary to load. See
  230. https://github.com/curl/curl/issues/349
  231. 1.12 updated DNS server while running
  232. If /etc/resolv.conf gets updated while a program using libcurl is running, it
  233. is may cause name resolves to fail unless res_init() is called. We should
  234. consider calling res_init() + retry once unconditionally on all name resolve
  235. failures to mitigate against this. Firefox works like that. Note that Windows
  236. does not have res_init() or an alternative.
  237. https://github.com/curl/curl/issues/2251
  238. 1.13 c-ares and CURLOPT_OPENSOCKETFUNCTION
  239. curl creates most sockets via the CURLOPT_OPENSOCKETFUNCTION callback and
  240. close them with the CURLOPT_CLOSESOCKETFUNCTION callback. However, c-ares
  241. does not use those functions and instead opens and closes the sockets itself.
  242. This means that when curl passes the c-ares socket to the
  243. CURLMOPT_SOCKETFUNCTION it is not owned by the application like other
  244. sockets.
  245. See https://github.com/curl/curl/issues/2734
  246. 1.14 connect to multiple IPs in parallel
  247. curl currently implements the happy eyeball algorithm for connecting to the
  248. IPv4 and IPv6 alternatives for a host in parallel, sticking with the
  249. connection that "wins". We could implement a similar algorithm per individual
  250. IP family as well when there are multiple available addresses: start with the
  251. first address, then start a second attempt N milliseconds after and then a
  252. third another N milliseconds later. That way there would be less waiting when
  253. the first IP has problems. It also improves the connection timeout value
  254. handling for multiple address situations.
  255. 1.15 Monitor connections in the connection pool
  256. libcurl's connection cache or pool holds a number of open connections for the
  257. purpose of possible subsequent connection reuse. It may contain a few up to a
  258. significant amount of connections. Currently, libcurl leaves all connections
  259. as they are and first when a connection is iterated over for matching or
  260. reuse purpose it is verified that it is still alive.
  261. Those connections may get closed by the server side for idleness or they may
  262. get an HTTP/2 ping from the peer to verify that they are still alive. By
  263. adding monitoring of the connections while in the pool, libcurl can detect
  264. dead connections (and close them) better and earlier, and it can handle
  265. HTTP/2 pings to keep such ones alive even when not actively doing transfers
  266. on them.
  267. 1.16 Try to URL encode given URL
  268. Given a URL that for example contains spaces, libcurl could have an option
  269. that would try somewhat harder than it does now and convert spaces to %20 and
  270. perhaps URL encoded byte values over 128 etc (basically do what the redirect
  271. following code already does).
  272. https://github.com/curl/curl/issues/514
  273. 1.17 Add support for IRIs
  274. IRIs (RFC 3987) allow localized, non-ASCII, names in the URL. To properly
  275. support this, curl/libcurl would need to translate/encode the given input
  276. from the input string encoding into percent encoded output "over the wire".
  277. To make that work smoothly for curl users even on Windows, curl would
  278. probably need to be able to convert from several input encodings.
  279. 1.18 try next proxy if one does not work
  280. Allow an application to specify a list of proxies to try, and failing to
  281. connect to the first go on and try the next instead until the list is
  282. exhausted. Browsers support this feature at least when they specify proxies
  283. using PACs.
  284. https://github.com/curl/curl/issues/896
  285. 1.19 provide timing info for each redirect
  286. curl and libcurl provide timing information via a set of different
  287. time-stamps (CURLINFO_*_TIME). When curl is following redirects, those
  288. returned time value are the accumulated sums. An improvement could be to
  289. offer separate timings for each redirect.
  290. https://github.com/curl/curl/issues/6743
  291. 1.20 SRV and URI DNS records
  292. Offer support for resolving SRV and URI DNS records for libcurl to know which
  293. server to connect to for various protocols (including HTTP).
  294. 1.21 netrc caching and sharing
  295. The netrc file is read and parsed each time a connection is setup, which
  296. means that if a transfer needs multiple connections for authentication or
  297. redirects, the file might be reread (and parsed) multiple times. This makes
  298. it impossible to provide the file as a pipe.
  299. 1.22 CURLINFO_PAUSE_STATE
  300. Return information about the transfer's current pause state, in both
  301. directions. https://github.com/curl/curl/issues/2588
  302. 1.23 Offer API to flush the connection pool
  303. Sometimes applications want to flush all the existing connections kept alive.
  304. An API could allow a forced flush or just a forced loop that would properly
  305. close all connections that have been closed by the server already.
  306. 1.25 Expose tried IP addresses that failed
  307. When libcurl fails to connect to a host, it could offer the application the
  308. addresses that were used in the attempt. Source + dest IP, source + dest port
  309. and protocol (UDP or TCP) for each failure. Possibly as a callback. Perhaps
  310. also provide "reason".
  311. https://github.com/curl/curl/issues/2126
  312. 1.28 FD_CLOEXEC
  313. It sets the close-on-exec flag for the file descriptor, which causes the file
  314. descriptor to be automatically (and atomically) closed when any of the
  315. exec-family functions succeed. Should probably be set by default?
  316. https://github.com/curl/curl/issues/2252
  317. 1.29 WebSocket read callback
  318. Call the read callback once the connection is established to allow sending
  319. the first message in the connection.
  320. https://github.com/curl/curl/issues/11402
  321. 1.30 config file parsing
  322. Consider providing an API, possibly in a separate companion library, for
  323. parsing a config file like curl's -K/--config option to allow applications to
  324. get the same ability to read curl options from files.
  325. See https://github.com/curl/curl/issues/3698
  326. 1.31 erase secrets from heap/stack after use
  327. Introducing a concept and system to erase secrets from memory after use, it
  328. could help mitigate and lessen the impact of (future) security problems etc.
  329. However: most secrets are passed to libcurl as clear text from the
  330. application and then clearing them within the library adds nothing...
  331. https://github.com/curl/curl/issues/7268
  332. 1.32 add asynch getaddrinfo support
  333. Use getaddrinfo_a() to provide an asynch name resolver backend to libcurl
  334. that does not use threads and does not depend on c-ares. The getaddrinfo_a
  335. function is (probably?) glibc specific but that is a widely used libc among
  336. our users.
  337. https://github.com/curl/curl/pull/6746
  338. 1.33 make DoH inherit more transfer properties
  339. Some options are not inherited because they are not relevant for the DoH SSL
  340. connections, or inheriting the option may result in unexpected behavior. For
  341. example the user's debug function callback is not inherited because it would
  342. be unexpected for internal handles (ie DoH handles) to be passed to that
  343. callback.
  344. If an option is not inherited then it is not possible to set it separately
  345. for DoH without a DoH-specific option. For example:
  346. CURLOPT_DOH_SSL_VERIFYHOST, CURLOPT_DOH_SSL_VERIFYPEER and
  347. CURLOPT_DOH_SSL_VERIFYSTATUS.
  348. See https://github.com/curl/curl/issues/6605
  349. 2. libcurl - multi interface
  350. 2.1 More non-blocking
  351. Make sure we do not ever loop because of non-blocking sockets returning
  352. EWOULDBLOCK or similar. Blocking cases include:
  353. - Name resolves on non-Windows unless c-ares or the threaded resolver is used.
  354. - The threaded resolver may block on cleanup:
  355. https://github.com/curl/curl/issues/4852
  356. - file:// transfers
  357. - TELNET transfers
  358. - GSSAPI authentication for FTP transfers
  359. - The "DONE" operation (post transfer protocol-specific actions) for the
  360. protocols SFTP, SMTP, FTP. Fixing multi_done() for this is a worthy task.
  361. - curl_multi_remove_handle for any of the above. See section 2.3.
  362. - Calling curl_ws_send() from a callback
  363. 2.2 Better support for same name resolves
  364. If a name resolve has been initiated for name NN and a second easy handle
  365. wants to resolve that name as well, make it wait for the first resolve to end
  366. up in the cache instead of doing a second separate resolve. This is
  367. especially needed when adding many simultaneous handles using the same host
  368. name when the DNS resolver can get flooded.
  369. 2.3 Non-blocking curl_multi_remove_handle()
  370. The multi interface has a few API calls that assume a blocking behavior, like
  371. add_handle() and remove_handle() which limits what we can do internally. The
  372. multi API need to be moved even more into a single function that "drives"
  373. everything in a non-blocking manner and signals when something is done. A
  374. remove or add would then only ask for the action to get started and then
  375. multi_perform() etc still be called until the add/remove is completed.
  376. 2.4 Split connect and authentication process
  377. The multi interface treats the authentication process as part of the connect
  378. phase. As such any failures during authentication does not trigger the
  379. relevant QUIT or LOGOFF for protocols such as IMAP, POP3 and SMTP.
  380. 2.5 Edge-triggered sockets should work
  381. The multi_socket API should work with edge-triggered socket events. One of
  382. the internal actions that need to be improved for this to work perfectly is
  383. the 'maxloops' handling in transfer.c:readwrite_data().
  384. 2.6 multi upkeep
  385. In libcurl 7.62.0 we introduced curl_easy_upkeep. It unfortunately only works
  386. on easy handles. We should introduces a version of that for the multi handle,
  387. and also consider doing "upkeep" automatically on connections in the
  388. connection pool when the multi handle is in used.
  389. See https://github.com/curl/curl/issues/3199
  390. 2.7 Virtual external sockets
  391. libcurl performs operations on the given file descriptor that presumes it is
  392. a socket and an application cannot replace them at the moment. Allowing an
  393. application to fully replace those would allow a larger degree of freedom and
  394. flexibility.
  395. See https://github.com/curl/curl/issues/5835
  396. 2.8 dynamically decide to use socketpair
  397. For users who do not use curl_multi_wait() or do not care for
  398. curl_multi_wakeup(), we could introduce a way to make libcurl NOT
  399. create a socketpair in the multi handle.
  400. See https://github.com/curl/curl/issues/4829
  401. 3. Documentation
  402. 3.1 Improve documentation about fork safety
  403. See https://github.com/curl/curl/issues/6968
  404. 3.2 Provide cmake config-file
  405. A config-file package is a set of files provided by us to allow applications
  406. to write cmake scripts to find and use libcurl easier. See
  407. https://github.com/curl/curl/issues/885
  408. 4. FTP
  409. 4.1 HOST
  410. HOST is a command for a client to tell which hostname to use, to offer FTP
  411. servers named-based virtual hosting:
  412. https://datatracker.ietf.org/doc/html/rfc7151
  413. 4.4 Support CURLOPT_PREQUOTE for directions listings
  414. The lack of support is mostly an oversight and requires the FTP state machine
  415. to get updated to get fixed.
  416. https://github.com/curl/curl/issues/8602
  417. 4.6 GSSAPI via Windows SSPI
  418. In addition to currently supporting the SASL GSSAPI mechanism (Kerberos V5)
  419. via third-party GSS-API libraries, such as Heimdal or MIT Kerberos, also add
  420. support for GSSAPI authentication via Windows SSPI.
  421. 4.7 STAT for LIST without data connection
  422. Some FTP servers allow STAT for listing directories instead of using LIST,
  423. and the response is then sent over the control connection instead of as the
  424. otherwise usedw data connection: https://www.nsftools.com/tips/RawFTP.htm#STAT
  425. This is not detailed in any FTP specification.
  426. 4.8 Passive transfer could try other IP addresses
  427. When doing FTP operations through a proxy at localhost, the reported spotted
  428. that curl only tried to connect once to the proxy, while it had multiple
  429. addresses and a failed connect on one address should make it try the next.
  430. After switching to passive mode (EPSV), curl could try all IP addresses for
  431. "localhost". Currently it tries ::1, but it should also try 127.0.0.1.
  432. See https://github.com/curl/curl/issues/1508
  433. 5. HTTP
  434. 5.1 Provide the error body from a CONNECT response
  435. When curl receives a body response from a CONNECT request to a proxy, it
  436. always just reads and ignores it. It would make some users happy if curl
  437. instead optionally would be able to make that responsible available. Via a
  438. new callback? Through some other means?
  439. See https://github.com/curl/curl/issues/9513
  440. 5.2 Obey Retry-After in redirects
  441. The Retry-After is said to dicate "the minimum time that the user agent is
  442. asked to wait before issuing the redirected request" and libcurl does not
  443. obey this.
  444. See https://github.com/curl/curl/issues/11447
  445. 5.3 Rearrange request header order
  446. Server implementers often make an effort to detect browser and to reject
  447. clients it can detect to not match. One of the last details we cannot yet
  448. control in libcurl's HTTP requests, which also can be exploited to detect
  449. that libcurl is in fact used even when it tries to impersonate a browser, is
  450. the order of the request headers. I propose that we introduce a new option in
  451. which you give headers a value, and then when the HTTP request is built it
  452. sorts the headers based on that number. We could then have internally created
  453. headers use a default value so only headers that need to be moved have to be
  454. specified.
  455. 5.4 Allow SAN names in HTTP/2 server push
  456. curl only allows HTTP/2 push promise if the provided :authority header value
  457. exactly matches the hostname given in the URL. It could be extended to allow
  458. any name that would match the Subject Alternative Names in the server's TLS
  459. certificate.
  460. See https://github.com/curl/curl/pull/3581
  461. 5.5 auth= in URLs
  462. Add the ability to specify the preferred authentication mechanism to use by
  463. using ;auth=<mech> in the login part of the URL.
  464. For example:
  465. http://test:pass;auth=NTLM@example.com would be equivalent to specifying
  466. --user test:pass;auth=NTLM or --user test:pass --ntlm from the command line.
  467. Additionally this should be implemented for proxy base URLs as well.
  468. 5.6 alt-svc should fallback if alt-svc does not work
  469. The alt-svc: header provides a set of alternative services for curl to use
  470. instead of the original. If the first attempted one fails, it should try the
  471. next etc and if all alternatives fail go back to the original.
  472. See https://github.com/curl/curl/issues/4908
  473. 5.7 Require HTTP version X or higher
  474. curl and libcurl provide options for trying higher HTTP versions (for example
  475. HTTP/2) but then still allows the server to pick version 1.1. We could
  476. consider adding a way to require a minimum version.
  477. See https://github.com/curl/curl/issues/7980
  478. 6. TELNET
  479. 6.1 ditch stdin
  480. Reading input (to send to the remote server) on stdin is a crappy solution
  481. for library purposes. We need to invent a good way for the application to be
  482. able to provide the data to send.
  483. 6.2 ditch telnet-specific select
  484. Move the telnet support's network select() loop go away and merge the code
  485. into the main transfer loop. Until this is done, the multi interface does not
  486. work for telnet.
  487. 6.3 feature negotiation debug data
  488. Add telnet feature negotiation data to the debug callback as header data.
  489. 6.4 exit immediately upon connection if stdin is /dev/null
  490. If it did, curl could be used to probe if there is an server there listening
  491. on a specific port. That is, the following command would exit immediately
  492. after the connection is established with exit code 0:
  493. curl -s --connect-timeout 2 telnet://example.com:80 </dev/null
  494. 7. SMTP
  495. 7.1 Passing NOTIFY option to CURLOPT_MAIL_RCPT
  496. Is there a way to pass the NOTIFY option to the CURLOPT_MAIL_RCPT option ? I
  497. set a string that already contains a bracket. For instance something like
  498. that: curl_slist_append( recipients, "<foo@bar> NOTIFY=SUCCESS,FAILURE" );
  499. https://github.com/curl/curl/issues/8232
  500. 7.2 Enhanced capability support
  501. Add the ability, for an application that uses libcurl, to obtain the list of
  502. capabilities returned from the EHLO command.
  503. 7.3 Add CURLOPT_MAIL_CLIENT option
  504. Rather than use the URL to specify the mail client string to present in the
  505. HELO and EHLO commands, libcurl should support a new CURLOPT specifically for
  506. specifying this data as the URL is non-standard and to be honest a bit of a
  507. hack ;-)
  508. Please see the following thread for more information:
  509. https://curl.se/mail/lib-2012-05/0178.html
  510. 8. POP3
  511. 8.2 Enhanced capability support
  512. Add the ability, for an application that uses libcurl, to obtain the list of
  513. capabilities returned from the CAPA command.
  514. 9. IMAP
  515. 9.1 Enhanced capability support
  516. Add the ability, for an application that uses libcurl, to obtain the list of
  517. capabilities returned from the CAPABILITY command.
  518. 10. LDAP
  519. 10.1 SASL based authentication mechanisms
  520. Currently the LDAP module only supports ldap_simple_bind_s() in order to bind
  521. to an LDAP server. However, this function sends username and password details
  522. using the simple authentication mechanism (as clear text). However, it should
  523. be possible to use ldap_bind_s() instead specifying the security context
  524. information ourselves.
  525. 10.2 CURLOPT_SSL_CTX_FUNCTION for LDAPS
  526. CURLOPT_SSL_CTX_FUNCTION works perfectly for HTTPS and email protocols, but
  527. it has no effect for LDAPS connections.
  528. https://github.com/curl/curl/issues/4108
  529. 10.3 Paged searches on LDAP server
  530. https://github.com/curl/curl/issues/4452
  531. 10.4 Certificate-Based Authentication
  532. LDAPS not possible with macOS and Windows with Certificate-Based Authentication
  533. https://github.com/curl/curl/issues/9641
  534. 11. SMB
  535. 11.1 File listing support
  536. Add support for listing the contents of a SMB share. The output should
  537. probably be the same as/similar to FTP.
  538. 11.2 Honor file timestamps
  539. The timestamp of the transferred file should reflect that of the original
  540. file.
  541. 11.3 Use NTLMv2
  542. Currently the SMB authentication uses NTLMv1.
  543. 11.4 Create remote directories
  544. Support for creating remote directories when uploading a file to a directory
  545. that does not exist on the server, just like --ftp-create-dirs.
  546. 12. FILE
  547. 12.1 Directory listing on non-POSIX
  548. Listing the contents of a directory accessed with FILE only works on
  549. platforms with opendir. Support could be added for more systems, like
  550. Windows.
  551. 13. TLS
  552. 13.1 TLS-PSK with OpenSSL
  553. Transport Layer Security pre-shared key ciphersuites (TLS-PSK) is a set of
  554. cryptographic protocols that provide secure communication based on pre-shared
  555. keys (PSKs). These pre-shared keys are symmetric keys shared in advance among
  556. the communicating parties.
  557. https://github.com/curl/curl/issues/5081
  558. 13.2 TLS channel binding
  559. TLS 1.2 and 1.3 provide the ability to extract some secret data from the TLS
  560. connection and use it in the client request (usually in some sort of
  561. authentication) to ensure that the data sent is bound to the specific TLS
  562. connection and cannot be successfully intercepted by a proxy. This
  563. functionality can be used in a standard authentication mechanism such as
  564. GSS-API or SCRAM, or in custom approaches like custom HTTP Authentication
  565. headers.
  566. For TLS 1.2, the binding type is usually tls-unique, and for TLS 1.3 it is
  567. tls-exporter.
  568. https://datatracker.ietf.org/doc/html/rfc5929
  569. https://datatracker.ietf.org/doc/html/rfc9266
  570. https://github.com/curl/curl/issues/9226
  571. 13.3 Defeat TLS fingerprinting
  572. By changing the order of TLS extensions provided in the TLS handshake, it is
  573. sometimes possible to circumvent TLS fingerprinting by servers. The TLS
  574. extension order is of course not the only way to fingerprint a client.
  575. 13.5 Export session ids
  576. Add an interface to libcurl that enables "session IDs" to get
  577. exported/imported. Cris Bailiff said: "OpenSSL has functions which can
  578. serialise the current SSL state to a buffer of your choice, and recover/reset
  579. the state from such a buffer at a later date - this is used by mod_ssl for
  580. apache to implement and SSL session ID cache".
  581. 13.6 Provide callback for cert verification
  582. OpenSSL supports a callback for customised verification of the peer
  583. certificate, but this does not seem to be exposed in the libcurl APIs. Could
  584. it be? There is so much that could be done if it were.
  585. 13.7 Less memory massaging with Schannel
  586. The Schannel backend does a lot of custom memory management we would rather
  587. avoid: the repeated alloc + free in sends and the custom memory + realloc
  588. system for encrypted and decrypted data. That should be avoided and reduced
  589. for 1) efficiency and 2) safety.
  590. 13.8 Support DANE
  591. DNS-Based Authentication of Named Entities (DANE) is a way to provide SSL
  592. keys and certs over DNS using DNSSEC as an alternative to the CA model.
  593. https://www.rfc-editor.org/rfc/rfc6698.txt
  594. An initial patch was posted by Suresh Krishnaswamy on March 7th 2013
  595. (https://curl.se/mail/lib-2013-03/0075.html) but it was a too simple
  596. approach. See Daniel's comments:
  597. https://curl.se/mail/lib-2013-03/0103.html . libunbound may be the
  598. correct library to base this development on.
  599. Björn Stenberg wrote a separate initial take on DANE that was never
  600. completed.
  601. 13.9 TLS record padding
  602. TLS (1.3) offers optional record padding and OpenSSL provides an API for it.
  603. I could make sense for libcurl to offer this ability to applications to make
  604. traffic patterns harder to figure out by network traffic observers.
  605. See https://github.com/curl/curl/issues/5398
  606. 13.10 Support Authority Information Access certificate extension (AIA)
  607. AIA can provide various things like CRLs but more importantly information
  608. about intermediate CA certificates that can allow validation path to be
  609. fulfilled when the HTTPS server does not itself provide them.
  610. Since AIA is about downloading certs on demand to complete a TLS handshake,
  611. it is probably a bit tricky to get done right.
  612. See https://github.com/curl/curl/issues/2793
  613. 13.11 Some TLS options are not offered for HTTPS proxies
  614. Some TLS related options to the command line tool and libcurl are only
  615. provided for the server and not for HTTPS proxies. --proxy-tls-max,
  616. --proxy-tlsv1.3, --proxy-curves and a few more.
  617. For more Documentation on this see:
  618. https://curl.se/libcurl/c/tls-options.html
  619. https://github.com/curl/curl/issues/12286
  620. 13.13 Make sure we forbid TLS 1.3 post-handshake authentication
  621. RFC 8740 explains how using HTTP/2 must forbid the use of TLS 1.3
  622. post-handshake authentication. We should make sure to live up to that.
  623. See https://github.com/curl/curl/issues/5396
  624. 13.14 Support the clienthello extension
  625. Certain stupid networks and middle boxes have a problem with SSL handshake
  626. packets that are within a certain size range because how that sets some bits
  627. that previously (in older TLS version) were not set. The clienthello
  628. extension adds padding to avoid that size range.
  629. https://datatracker.ietf.org/doc/html/rfc7685
  630. https://github.com/curl/curl/issues/2299
  631. 13.15 Select signature algorithms
  632. Consider adding an option or a way for users to select TLS signature
  633. algorithm. The signature algorithms set by a client are used directly in the
  634. supported signature algorithm in the client hello message.
  635. https://github.com/curl/curl/issues/12982
  636. 13.16 Share the CA cache
  637. For TLS backends that supports CA caching, it makes sense to allow the share
  638. object to be used to store the CA cache as well via the share API. Would
  639. allow multiple easy handles to reuse the CA cache and save themselves from a
  640. lot of extra processing overhead.
  641. 13.17 Add missing features to TLS backends
  642. The feature matrix at https://curl.se/libcurl/c/tls-options.html shows which
  643. features are supported by which TLS backends, and thus also where there are
  644. feature gaps.
  645. 15. Schannel
  646. 15.1 Extend support for client certificate authentication
  647. The existing support for the -E/--cert and --key options could be
  648. extended by supplying a custom certificate and key in PEM format, see:
  649. - Getting a Certificate for Schannel
  650. https://msdn.microsoft.com/en-us/library/windows/desktop/aa375447.aspx
  651. 15.2 Extend support for the --ciphers option
  652. The existing support for the --ciphers option could be extended
  653. by mapping the OpenSSL/GnuTLS cipher suites to the Schannel APIs, see
  654. - Specifying Schannel Ciphers and Cipher Strengths
  655. https://msdn.microsoft.com/en-us/library/windows/desktop/aa380161.aspx
  656. 15.4 Add option to allow abrupt server closure
  657. libcurl w/schannel errors without a known termination point from the server
  658. (such as length of transfer, or SSL "close notify" alert) to prevent against
  659. a truncation attack. Really old servers may neglect to send any termination
  660. point. An option could be added to ignore such abrupt closures.
  661. https://github.com/curl/curl/issues/4427
  662. 16. SASL
  663. 16.1 Other authentication mechanisms
  664. Add support for other authentication mechanisms such as OLP,
  665. GSS-SPNEGO and others.
  666. 16.2 Add QOP support to GSSAPI authentication
  667. Currently the GSSAPI authentication only supports the default QOP of auth
  668. (Authentication), whilst Kerberos V5 supports both auth-int (Authentication
  669. with integrity protection) and auth-conf (Authentication with integrity and
  670. privacy protection).
  671. 17. SSH protocols
  672. 17.1 Multiplexing
  673. SSH is a perfectly fine multiplexed protocols which would allow libcurl to do
  674. multiple parallel transfers from the same host using the same connection,
  675. much in the same spirit as HTTP/2 does. libcurl however does not take
  676. advantage of that ability but does instead always create a new connection for
  677. new transfers even if an existing connection already exists to the host.
  678. To fix this, libcurl would have to detect an existing connection and "attach"
  679. the new transfer to the existing one.
  680. 17.2 Handle growing SFTP files
  681. The SFTP code in libcurl checks the file size *before* a transfer starts and
  682. then proceeds to transfer exactly that amount of data. If the remote file
  683. grows while the transfer is in progress libcurl does not notice and does not
  684. adapt. The OpenSSH SFTP command line tool does and libcurl could also just
  685. attempt to download more to see if there is more to get...
  686. https://github.com/curl/curl/issues/4344
  687. 17.3 Read keys from ~/.ssh/id_ecdsa, id_ed25519
  688. The libssh2 backend in curl is limited to only reading keys from id_rsa and
  689. id_dsa, which makes it fail connecting to servers that use more modern key
  690. types.
  691. https://github.com/curl/curl/issues/8586
  692. 17.4 Support CURLOPT_PREQUOTE
  693. The two other QUOTE options are supported for SFTP, but this was left out for
  694. unknown reasons.
  695. 17.5 SSH over HTTPS proxy with more backends
  696. The SSH based protocols SFTP and SCP did not work over HTTPS proxy at
  697. all until PR https://github.com/curl/curl/pull/6021 brought the
  698. functionality with the libssh2 backend. Presumably, this support
  699. can/could be added for the other backends as well.
  700. 17.6 SFTP with SCP://
  701. OpenSSH 9 switched their 'scp' tool to speak SFTP under the hood. Going
  702. forward it might be worth having curl or libcurl attempt SFTP if SCP fails to
  703. follow suite.
  704. 18. Command line tool
  705. 18.1 sync
  706. "curl --sync http://example.com/feed[1-100].rss" or
  707. "curl --sync http://example.net/{index,calendar,history}.html"
  708. Downloads a range or set of URLs using the remote name, but only if the
  709. remote file is newer than the local file. A Last-Modified HTTP date header
  710. should also be used to set the mod date on the downloaded file.
  711. 18.2 glob posts
  712. Globbing support for -d and -F, as in 'curl -d "name=foo[0-9]" URL'.
  713. This is easily scripted though.
  714. 18.4 --proxycommand
  715. Allow the user to make curl run a command and use its stdio to make requests
  716. and not do any network connection by itself. Example:
  717. curl --proxycommand 'ssh pi@raspberrypi.local -W 10.1.1.75 80' \
  718. http://some/otherwise/unavailable/service.php
  719. See https://github.com/curl/curl/issues/4941
  720. 18.5 UTF-8 filenames in Content-Disposition
  721. RFC 6266 documents how UTF-8 names can be passed to a client in the
  722. Content-Disposition header, and curl does not support this.
  723. https://github.com/curl/curl/issues/1888
  724. 18.6 Option to make -Z merge lined based outputs on stdout
  725. When a user requests multiple lined based files using -Z and sends them to
  726. stdout, curl does not "merge" and send complete lines fine but may send
  727. partial lines from several sources.
  728. https://github.com/curl/curl/issues/5175
  729. 18.7 specify which response codes that make -f/--fail return error
  730. Allows a user to better specify exacly which error code(s) that are fine
  731. and which are errors for their specific uses cases
  732. 18.9 Choose the name of file in braces for complex URLs
  733. When using braces to download a list of URLs and you use complicated names
  734. in the list of alternatives, it could be handy to allow curl to use other
  735. names when saving.
  736. Consider a way to offer that. Possibly like
  737. {partURL1:name1,partURL2:name2,partURL3:name3} where the name following the
  738. colon is the output name.
  739. See https://github.com/curl/curl/issues/221
  740. 18.10 improve how curl works in a Windows console window
  741. If you pull the scrollbar when transferring with curl in a Windows console
  742. window, the transfer is interrupted and can get disconnected. This can
  743. probably be improved. See https://github.com/curl/curl/issues/322
  744. 18.11 Windows: set attribute 'archive' for completed downloads
  745. The archive bit (FILE_ATTRIBUTE_ARCHIVE, 0x20) separates files that shall be
  746. backed up from those that are either not ready or have not changed.
  747. Downloads in progress are neither ready to be backed up, nor should they be
  748. opened by a different process. Only after a download has been completed it is
  749. sensible to include it in any integer snapshot or backup of the system.
  750. See https://github.com/curl/curl/issues/3354
  751. 18.12 keep running, read instructions from pipe/socket
  752. Provide an option that makes curl not exit after the last URL (or even work
  753. without a given URL), and then make it read instructions passed on a pipe or
  754. over a socket to make further instructions so that a second subsequent curl
  755. invoke can talk to the still running instance and ask for transfers to get
  756. done, and thus maintain its connection pool, DNS cache and more.
  757. 18.13 Acknowledge Ratelimit headers
  758. Consider a command line option that can make curl do multiple serial requests
  759. while acknowledging server specified rate limits:
  760. https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/
  761. See https://github.com/curl/curl/issues/5406
  762. 18.14 --dry-run
  763. A command line option that makes curl show exactly what it would do and send
  764. if it would run for real.
  765. See https://github.com/curl/curl/issues/5426
  766. 18.15 --retry should resume
  767. When --retry is used and curl actually retries transfer, it should use the
  768. already transferred data and do a resumed transfer for the rest (when
  769. possible) so that it does not have to transfer the same data again that was
  770. already transferred before the retry.
  771. See https://github.com/curl/curl/issues/1084
  772. 18.16 send only part of --data
  773. When the user only wants to send a small piece of the data provided with
  774. --data or --data-binary, like when that data is a huge file, consider a way
  775. to specify that curl should only send a piece of that. One suggested syntax
  776. would be: "--data-binary @largefile.zip!1073741823-2147483647".
  777. See https://github.com/curl/curl/issues/1200
  778. 18.17 consider filename from the redirected URL with -O ?
  779. When a user gives a URL and uses -O, and curl follows a redirect to a new
  780. URL, the filename is not extracted and used from the newly redirected-to URL
  781. even if the new URL may have a much more sensible filename.
  782. This is clearly documented and helps for security since there is no surprise
  783. to users which filename that might get overwritten, but maybe a new option
  784. could allow for this or maybe -J should imply such a treatment as well as -J
  785. already allows for the server to decide what filename to use so it already
  786. provides the "may overwrite any file" risk.
  787. This is extra tricky if the original URL has no filename part at all since
  788. then the current code path does error out with an error message, and we
  789. cannot *know* already at that point if curl is redirected to a URL that has a
  790. filename...
  791. See https://github.com/curl/curl/issues/1241
  792. 18.18 retry on network is unreachable
  793. The --retry option retries transfers on "transient failures". We later added
  794. --retry-connrefused to also retry for "connection refused" errors.
  795. Suggestions have been brought to also allow retry on "network is unreachable"
  796. errors and while totally reasonable, maybe we should consider a way to make
  797. this more configurable than to add a new option for every new error people
  798. want to retry for?
  799. https://github.com/curl/curl/issues/1603
  800. 18.19 expand ~/ in config files
  801. For example .curlrc could benefit from being able to do this.
  802. See https://github.com/curl/curl/issues/2317
  803. 18.20 hostname sections in config files
  804. config files would be more powerful if they could set different
  805. configurations depending on used URLs, hostname or possibly origin. Then a
  806. default .curlrc could a specific user-agent only when doing requests against
  807. a certain site.
  808. 18.21 retry on the redirected-to URL
  809. When curl is told to --retry a failed transfer and follows redirects, it
  810. might get an HTTP 429 response from the redirected-to URL and not the
  811. original one, which then could make curl decide to rather retry the transfer
  812. on that URL only instead of the original operation to the original URL.
  813. Perhaps extra emphasized if the original transfer is a large POST that
  814. redirects to a separate GET, and that GET is what gets the 529
  815. See https://github.com/curl/curl/issues/5462
  816. 18.23 Set the modification date on an uploaded file
  817. For SFTP and possibly FTP, curl could offer an option to set the
  818. modification time for the uploaded file.
  819. See https://github.com/curl/curl/issues/5768
  820. 18.24 Use multiple parallel transfers for a single download
  821. To enhance transfer speed, downloading a single URL can be split up into
  822. multiple separate range downloads that get combined into a single final
  823. result.
  824. An ideal implementation would not use a specified number of parallel
  825. transfers, but curl could:
  826. - First start getting the full file as transfer A
  827. - If after N seconds have passed and the transfer is expected to continue for
  828. M seconds or more, add a new transfer (B) that asks for the second half of
  829. A's content (and stop A at the middle).
  830. - If splitting up the work improves the transfer rate, it could then be done
  831. again. Then again, etc up to a limit.
  832. This way, if transfer B fails (because Range: is not supported) it lets
  833. transfer A remain the single one. N and M could be set to some sensible
  834. defaults.
  835. See https://github.com/curl/curl/issues/5774
  836. 18.25 Prevent terminal injection when writing to terminal
  837. curl could offer an option to make escape sequence either non-functional or
  838. avoid cursor moves or similar to reduce the risk of a user getting tricked by
  839. clever tricks.
  840. See https://github.com/curl/curl/issues/6150
  841. 18.26 Custom progress meter update interval
  842. Users who are for example doing large downloads in CI or remote setups might
  843. want the occasional progress meter update to see that the transfer is
  844. progressing and has not stuck, but they may not appreciate the
  845. many-times-a-second frequency curl can end up doing it with now.
  846. 18.27 -J and -O with %-encoded filenames
  847. -J/--remote-header-name does not decode %-encoded filenames. RFC 6266 details
  848. how it should be done. The can of worm is basically that we have no charset
  849. handling in curl and ASCII >=128 is a challenge for us. Not to mention that
  850. decoding also means that we need to check for nastiness that is attempted,
  851. like "../" sequences and the like. Probably everything to the left of any
  852. embedded slashes should be cut off.
  853. https://curl.se/bug/view.cgi?id=1294
  854. -O also does not decode %-encoded names, and while it has even less
  855. information about the charset involved the process is similar to the -J case.
  856. Note that we do not decode -O without the user asking for it with some other
  857. means, since -O has always been documented to use the name exactly as
  858. specified in the URL.
  859. 18.28 -J with -C -
  860. When using -J (with -O), automatically resumed downloading together with "-C
  861. -" fails. Without -J the same command line works. This happens because the
  862. resume logic is worked out before the target filename (and thus its
  863. pre-transfer size) has been figured out. This can be improved.
  864. https://curl.se/bug/view.cgi?id=1169
  865. 18.29 --retry and transfer timeouts
  866. If using --retry and the transfer timeouts (possibly due to using -m or
  867. -y/-Y) the next attempt does not resume the transfer properly from what was
  868. downloaded in the previous attempt but truncates and restarts at the original
  869. position where it was at before the previous failed attempt. See
  870. https://curl.se/mail/lib-2008-01/0080.html and Mandriva bug report
  871. https://qa.mandriva.com/show_bug.cgi?id=22565
  872. 19. Build
  873. 19.2 Enable PIE and RELRO by default
  874. Especially when having programs that execute curl via the command line, PIE
  875. renders the exploitation of memory corruption vulnerabilities a lot more
  876. difficult. This can be attributed to the additional information leaks being
  877. required to conduct a successful attack. RELRO, on the other hand, masks
  878. different binary sections like the GOT as read-only and thus kills a handful
  879. of techniques that come in handy when attackers are able to arbitrarily
  880. overwrite memory. A few tests showed that enabling these features had close
  881. to no impact, neither on the performance nor on the general functionality of
  882. curl.
  883. 19.3 Do not use GNU libtool on OpenBSD
  884. When compiling curl on OpenBSD with "--enable-debug" it gives linking errors
  885. when you use GNU libtool. This can be fixed by using the libtool provided by
  886. OpenBSD itself. However for this the user always needs to invoke make with
  887. "LIBTOOL=/usr/bin/libtool". It would be nice if the script could have some
  888. magic to detect if this system is an OpenBSD host and then use the OpenBSD
  889. libtool instead.
  890. See https://github.com/curl/curl/issues/5862
  891. 19.4 Package curl for Windows in a signed installer
  892. See https://github.com/curl/curl/issues/5424
  893. 19.5 make configure use --cache-file more and better
  894. The configure script can be improved to cache more values so that repeated
  895. invokes run much faster.
  896. See https://github.com/curl/curl/issues/7753
  897. 20. Test suite
  898. 20.1 SSL tunnel
  899. Make our own version of stunnel for simple port forwarding to enable HTTPS
  900. and FTP-SSL tests without the stunnel dependency, and it could allow us to
  901. provide test tools built with either OpenSSL or GnuTLS
  902. 20.2 nicer lacking perl message
  903. If perl was not found by the configure script, do not attempt to run the tests
  904. but explain something nice why it does not.
  905. 20.3 more protocols supported
  906. Extend the test suite to include more protocols. The telnet could just do FTP
  907. or http operations (for which we have test servers).
  908. 20.4 more platforms supported
  909. Make the test suite work on more platforms. OpenBSD and macOS. Remove
  910. fork()s and it should become even more portable.
  911. 20.6 Use the RFC 6265 test suite
  912. A test suite made for HTTP cookies (RFC 6265) by Adam Barth is available at
  913. https://github.com/abarth/http-state/tree/master/tests
  914. It would be good if someone would write a script/setup that would run curl
  915. with that test suite and detect deviances. Ideally, that would even be
  916. incorporated into our regular test suite.
  917. 20.8 Run web-platform-tests URL tests
  918. Run web-platform-tests URL tests and compare results with browsers on wpt.fyi
  919. It would help us find issues to fix and help us document where our parser
  920. differs from the WHATWG URL spec parsers.
  921. See https://github.com/curl/curl/issues/4477
  922. 21. MQTT
  923. 21.1 Support rate-limiting
  924. The rate-limiting logic is done in the PERFORMING state in multi.c but MQTT
  925. is not (yet) implemented to use that.
  926. 21.2 Support MQTTS
  927. 21.3 Handle network blocks
  928. Running test suite with
  929. `CURL_DBG_SOCK_WBLOCK=90 ./runtests.pl -a mqtt` makes several
  930. MQTT test cases fail where they should not.
  931. 22. TFTP
  932. 22.1 TFTP does not convert LF to CRLF for mode=netascii
  933. RFC 3617 defines that an TFTP transfer can be done using "netascii"
  934. mode. curl does not support extracting that mode from the URL nor does it treat
  935. such transfers specifically. It should probably do LF to CRLF translations
  936. for them.
  937. See https://github.com/curl/curl/issues/12655
  938. 23. Gopher
  939. 23.1 Handle network blocks
  940. Running test suite with
  941. `CURL_DBG_SOCK_WBLOCK=90 ./runtests.pl -a 1200 to 1300` makes several
  942. Gopher test cases fail where they should not.