TODO 49 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385
  1. _ _ ____ _
  2. ___| | | | _ \| |
  3. / __| | | | |_) | |
  4. | (__| |_| | _ <| |___
  5. \___|\___/|_| \_\_____|
  6. Things that could be nice to do in the future
  7. Things to do in project curl. Please tell us what you think, contribute and
  8. send us patches that improve things.
  9. Be aware that these are things that we could do, or have once been considered
  10. things we could do. If you want to work on any of these areas, please
  11. consider bringing it up for discussions first on the mailing list so that we
  12. all agree it is still a good idea for the project.
  13. All bugs documented in the KNOWN_BUGS document are subject for fixing.
  14. 1. libcurl
  15. 1.1 TFO support on Windows
  16. 1.2 Consult %APPDATA% also for .netrc
  17. 1.3 struct lifreq
  18. 1.4 alt-svc sharing
  19. 1.5 get rid of PATH_MAX
  20. 1.8 CURLOPT_RESOLVE for any port number
  21. 1.9 Cache negative name resolves
  22. 1.10 auto-detect proxy
  23. 1.11 minimize dependencies with dynamically loaded modules
  24. 1.12 updated DNS server while running
  25. 1.13 c-ares and CURLOPT_OPENSOCKETFUNCTION
  26. 1.14 connect to multiple IPs in parallel
  27. 1.15 Monitor connections in the connection pool
  28. 1.16 Try to URL encode given URL
  29. 1.17 Add support for IRIs
  30. 1.18 try next proxy if one does not work
  31. 1.19 provide timing info for each redirect
  32. 1.20 SRV and URI DNS records
  33. 1.21 netrc caching and sharing
  34. 1.22 CURLINFO_PAUSE_STATE
  35. 1.23 Offer API to flush the connection pool
  36. 1.25 Expose tried IP addresses that failed
  37. 1.28 FD_CLOEXEC
  38. 1.29 WebSocket read callback
  39. 1.30 config file parsing
  40. 1.31 erase secrets from heap/stack after use
  41. 1.32 add asynch getaddrinfo support
  42. 1.33 make DoH inherit more transfer properties
  43. 2. libcurl - multi interface
  44. 2.1 More non-blocking
  45. 2.2 Better support for same name resolves
  46. 2.3 Non-blocking curl_multi_remove_handle()
  47. 2.4 Split connect and authentication process
  48. 2.5 Edge-triggered sockets should work
  49. 2.6 multi upkeep
  50. 2.7 Virtual external sockets
  51. 2.8 dynamically decide to use socketpair
  52. 3. Documentation
  53. 3.1 Improve documentation about fork safety
  54. 3.2 Provide cmake config-file
  55. 4. FTP
  56. 4.1 HOST
  57. 4.2 Alter passive/active on failure and retry
  58. 4.4 Support CURLOPT_PREQUOTE for directories listings
  59. 4.5 ASCII support
  60. 4.6 GSSAPI via Windows SSPI
  61. 4.7 STAT for LIST without data connection
  62. 4.8 Passive transfer could try other IP addresses
  63. 5. HTTP
  64. 5.1 Provide the error body from a CONNECT response
  65. 5.2 Obey Retry-After in redirects
  66. 5.3 Rearrange request header order
  67. 5.4 Allow SAN names in HTTP/2 server push
  68. 5.5 auth= in URLs
  69. 5.6 alt-svc should fallback if alt-svc does not work
  70. 5.7 Require HTTP version X or higher
  71. 6. TELNET
  72. 6.1 ditch stdin
  73. 6.2 ditch telnet-specific select
  74. 6.3 feature negotiation debug data
  75. 6.4 exit immediately upon connection if stdin is /dev/null
  76. 7. SMTP
  77. 7.1 Passing NOTIFY option to CURLOPT_MAIL_RCPT
  78. 7.2 Enhanced capability support
  79. 7.3 Add CURLOPT_MAIL_CLIENT option
  80. 8. POP3
  81. 8.2 Enhanced capability support
  82. 9. IMAP
  83. 9.1 Enhanced capability support
  84. 10. LDAP
  85. 10.1 SASL based authentication mechanisms
  86. 10.2 CURLOPT_SSL_CTX_FUNCTION for LDAPS
  87. 10.3 Paged searches on LDAP server
  88. 10.4 Certificate-Based Authentication
  89. 11. SMB
  90. 11.1 File listing support
  91. 11.2 Honor file timestamps
  92. 11.3 Use NTLMv2
  93. 11.4 Create remote directories
  94. 12. FILE
  95. 12.1 Directory listing on non-POSIX
  96. 13. TLS
  97. 13.1 TLS-PSK with OpenSSL
  98. 13.2 TLS channel binding
  99. 13.3 Defeat TLS fingerprinting
  100. 13.5 Export session ids
  101. 13.6 Provide callback for cert verification
  102. 13.7 Less memory massaging with Schannel
  103. 13.8 Support DANE
  104. 13.9 TLS record padding
  105. 13.10 Support Authority Information Access certificate extension (AIA)
  106. 13.11 Some TLS options are not offered for HTTPS proxies
  107. 13.13 Make sure we forbid TLS 1.3 post-handshake authentication
  108. 13.14 Support the clienthello extension
  109. 13.15 Select signature algorithms
  110. 13.16 Share the CA cache
  111. 13.17 Add missing features to TLS backends
  112. 14. GnuTLS
  113. 14.2 check connection
  114. 15. Schannel
  115. 15.1 Extend support for client certificate authentication
  116. 15.2 Extend support for the --ciphers option
  117. 15.4 Add option to allow abrupt server closure
  118. 16. SASL
  119. 16.1 Other authentication mechanisms
  120. 16.2 Add QOP support to GSSAPI authentication
  121. 17. SSH protocols
  122. 17.1 Multiplexing
  123. 17.2 Handle growing SFTP files
  124. 17.3 Read keys from ~/.ssh/id_ecdsa, id_ed25519
  125. 17.4 Support CURLOPT_PREQUOTE
  126. 17.5 SSH over HTTPS proxy with more backends
  127. 17.6 SFTP with SCP://
  128. 18. Command line tool
  129. 18.1 sync
  130. 18.2 glob posts
  131. 18.3 -h option
  132. 18.4 --proxycommand
  133. 18.5 UTF-8 filenames in Content-Disposition
  134. 18.6 Option to make -Z merge lined based outputs on stdout
  135. 18.7 specify which response codes that make -f/--fail return error
  136. 18.9 Choose the name of file in braces for complex URLs
  137. 18.10 improve how curl works in a windows console window
  138. 18.11 Windows: set attribute 'archive' for completed downloads
  139. 18.12 keep running, read instructions from pipe/socket
  140. 18.13 Acknowledge Ratelimit headers
  141. 18.14 --dry-run
  142. 18.15 --retry should resume
  143. 18.16 send only part of --data
  144. 18.17 consider filename from the redirected URL with -O ?
  145. 18.18 retry on network is unreachable
  146. 18.19 expand ~/ in config files
  147. 18.20 hostname sections in config files
  148. 18.21 retry on the redirected-to URL
  149. 18.23 Set the modification date on an uploaded file
  150. 18.24 Use multiple parallel transfers for a single download
  151. 18.25 Prevent terminal injection when writing to terminal
  152. 18.26 Custom progress meter update interval
  153. 18.27 -J and -O with %-encoded filenames
  154. 18.28 -J with -C -
  155. 18.29 --retry and transfer timeouts
  156. 19. Build
  157. 19.2 Enable PIE and RELRO by default
  158. 19.3 Do not use GNU libtool on OpenBSD
  159. 19.4 Package curl for Windows in a signed installer
  160. 19.5 make configure use --cache-file more and better
  161. 19.6 build curl with Windows Unicode support
  162. 20. Test suite
  163. 20.1 SSL tunnel
  164. 20.2 nicer lacking perl message
  165. 20.3 more protocols supported
  166. 20.4 more platforms supported
  167. 20.6 Use the RFC 6265 test suite
  168. 20.8 Run web-platform-tests URL tests
  169. 21. MQTT
  170. 21.1 Support rate-limiting
  171. 21.2 Support MQTTS
  172. 22. TFTP
  173. 22.1 TFTP does not convert LF to CRLF for mode=netascii
  174. ==============================================================================
  175. 1. libcurl
  176. 1.1 TFO support on Windows
  177. libcurl supports the CURLOPT_TCP_FASTOPEN option since 7.49.0 for Linux and
  178. Mac OS. Windows supports TCP Fast Open starting with Windows 10, version 1607
  179. and we should add support for it.
  180. TCP Fast Open is supported on several platforms but not on Windows. Work on
  181. this was once started but never finished.
  182. See https://github.com/curl/curl/pull/3378
  183. 1.2 Consult %APPDATA% also for .netrc
  184. %APPDATA%\.netrc is not considered when running on Windows. should not it?
  185. See https://github.com/curl/curl/issues/4016
  186. 1.3 struct lifreq
  187. Use 'struct lifreq' and SIOCGLIFADDR instead of 'struct ifreq' and
  188. SIOCGIFADDR on newer Solaris versions as they claim the latter is obsolete.
  189. To support IPv6 interface addresses for network interfaces properly.
  190. 1.4 alt-svc sharing
  191. The share interface could benefit from allowing the alt-svc cache to be
  192. possible to share between easy handles.
  193. See https://github.com/curl/curl/issues/4476
  194. The share interface offers CURL_LOCK_DATA_CONNECT to have multiple easy
  195. handle share a connection cache, but due to how connections are used they are
  196. still not thread-safe when used shared.
  197. See https://github.com/curl/curl/issues/4915 and lib1541.c
  198. The share interface offers CURL_LOCK_DATA_HSTS to have multiple easy handle
  199. share a HSTS cache, but this is not thread-safe.
  200. 1.5 get rid of PATH_MAX
  201. Having code use and rely on PATH_MAX is not nice:
  202. https://insanecoding.blogspot.com/2007/11/pathmax-simply-isnt.html
  203. Currently the libssh2 SSH based code uses it, but to remove PATH_MAX from
  204. there we need libssh2 to properly tell us when we pass in a too small buffer
  205. and its current API (as of libssh2 1.2.7) does not.
  206. 1.8 CURLOPT_RESOLVE for any port number
  207. This option allows applications to set a replacement IP address for a given
  208. host + port pair. Consider making support for providing a replacement address
  209. for the hostname on all port numbers.
  210. See https://github.com/curl/curl/issues/1264
  211. 1.9 Cache negative name resolves
  212. A name resolve that has failed is likely to fail when made again within a
  213. short period of time. Currently we only cache positive responses.
  214. 1.10 auto-detect proxy
  215. libcurl could be made to detect the system proxy setup automatically and use
  216. that. On Windows, macOS and Linux desktops for example.
  217. The pull-request to use libproxy for this was deferred due to doubts on the
  218. reliability of the dependency and how to use it:
  219. https://github.com/curl/curl/pull/977
  220. libdetectproxy is a (C++) library for detecting the proxy on Windows
  221. https://github.com/paulharris/libdetectproxy
  222. 1.11 minimize dependencies with dynamically loaded modules
  223. We can create a system with loadable modules/plug-ins, where these modules
  224. would be the ones that link to 3rd party libs. That would allow us to avoid
  225. having to load ALL dependencies since only the necessary ones for this
  226. app/invoke/used protocols would be necessary to load. See
  227. https://github.com/curl/curl/issues/349
  228. 1.12 updated DNS server while running
  229. If /etc/resolv.conf gets updated while a program using libcurl is running, it
  230. is may cause name resolves to fail unless res_init() is called. We should
  231. consider calling res_init() + retry once unconditionally on all name resolve
  232. failures to mitigate against this. Firefox works like that. Note that Windows
  233. does not have res_init() or an alternative.
  234. https://github.com/curl/curl/issues/2251
  235. 1.13 c-ares and CURLOPT_OPENSOCKETFUNCTION
  236. curl creates most sockets via the CURLOPT_OPENSOCKETFUNCTION callback and
  237. close them with the CURLOPT_CLOSESOCKETFUNCTION callback. However, c-ares
  238. does not use those functions and instead opens and closes the sockets itself.
  239. This means that when curl passes the c-ares socket to the
  240. CURLMOPT_SOCKETFUNCTION it is not owned by the application like other
  241. sockets.
  242. See https://github.com/curl/curl/issues/2734
  243. 1.14 connect to multiple IPs in parallel
  244. curl currently implements the happy eyeball algorithm for connecting to the
  245. IPv4 and IPv6 alternatives for a host in parallel, sticking with the
  246. connection that "wins". We could implement a similar algorithm per individual
  247. IP family as well when there are multiple available addresses: start with the
  248. first address, then start a second attempt N milliseconds after and then a
  249. third another N milliseconds later. That way there would be less waiting when
  250. the first IP has problems. It also improves the connection timeout value
  251. handling for multiple address situations.
  252. 1.15 Monitor connections in the connection pool
  253. libcurl's connection cache or pool holds a number of open connections for the
  254. purpose of possible subsequent connection reuse. It may contain a few up to a
  255. significant amount of connections. Currently, libcurl leaves all connections
  256. as they are and first when a connection is iterated over for matching or
  257. reuse purpose it is verified that it is still alive.
  258. Those connections may get closed by the server side for idleness or they may
  259. get an HTTP/2 ping from the peer to verify that they are still alive. By
  260. adding monitoring of the connections while in the pool, libcurl can detect
  261. dead connections (and close them) better and earlier, and it can handle
  262. HTTP/2 pings to keep such ones alive even when not actively doing transfers
  263. on them.
  264. 1.16 Try to URL encode given URL
  265. Given a URL that for example contains spaces, libcurl could have an option
  266. that would try somewhat harder than it does now and convert spaces to %20 and
  267. perhaps URL encoded byte values over 128 etc (basically do what the redirect
  268. following code already does).
  269. https://github.com/curl/curl/issues/514
  270. 1.17 Add support for IRIs
  271. IRIs (RFC 3987) allow localized, non-ascii, names in the URL. To properly
  272. support this, curl/libcurl would need to translate/encode the given input
  273. from the input string encoding into percent encoded output "over the wire".
  274. To make that work smoothly for curl users even on Windows, curl would
  275. probably need to be able to convert from several input encodings.
  276. 1.18 try next proxy if one does not work
  277. Allow an application to specify a list of proxies to try, and failing to
  278. connect to the first go on and try the next instead until the list is
  279. exhausted. Browsers support this feature at least when they specify proxies
  280. using PACs.
  281. https://github.com/curl/curl/issues/896
  282. 1.19 provide timing info for each redirect
  283. curl and libcurl provide timing information via a set of different
  284. time-stamps (CURLINFO_*_TIME). When curl is following redirects, those
  285. returned time value are the accumulated sums. An improvement could be to
  286. offer separate timings for each redirect.
  287. https://github.com/curl/curl/issues/6743
  288. 1.20 SRV and URI DNS records
  289. Offer support for resolving SRV and URI DNS records for libcurl to know which
  290. server to connect to for various protocols (including HTTP).
  291. 1.21 netrc caching and sharing
  292. The netrc file is read and parsed each time a connection is setup, which
  293. means that if a transfer needs multiple connections for authentication or
  294. redirects, the file might be reread (and parsed) multiple times. This makes
  295. it impossible to provide the file as a pipe.
  296. 1.22 CURLINFO_PAUSE_STATE
  297. Return information about the transfer's current pause state, in both
  298. directions. https://github.com/curl/curl/issues/2588
  299. 1.23 Offer API to flush the connection pool
  300. Sometimes applications want to flush all the existing connections kept alive.
  301. An API could allow a forced flush or just a forced loop that would properly
  302. close all connections that have been closed by the server already.
  303. 1.25 Expose tried IP addresses that failed
  304. When libcurl fails to connect to a host, it could offer the application the
  305. addresses that were used in the attempt. Source + dest IP, source + dest port
  306. and protocol (UDP or TCP) for each failure. Possibly as a callback. Perhaps
  307. also provide "reason".
  308. https://github.com/curl/curl/issues/2126
  309. 1.28 FD_CLOEXEC
  310. It sets the close-on-exec flag for the file descriptor, which causes the file
  311. descriptor to be automatically (and atomically) closed when any of the
  312. exec-family functions succeed. Should probably be set by default?
  313. https://github.com/curl/curl/issues/2252
  314. 1.29 WebSocket read callback
  315. Call the read callback once the connection is established to allow sending
  316. the first message in the connection.
  317. https://github.com/curl/curl/issues/11402
  318. 1.30 config file parsing
  319. Consider providing an API, possibly in a separate companion library, for
  320. parsing a config file like curl's -K/--config option to allow applications to
  321. get the same ability to read curl options from files.
  322. See https://github.com/curl/curl/issues/3698
  323. 1.31 erase secrets from heap/stack after use
  324. Introducing a concept and system to erase secrets from memory after use, it
  325. could help mitigate and lessen the impact of (future) security problems etc.
  326. However: most secrets are passed to libcurl as clear text from the
  327. application and then clearing them within the library adds nothing...
  328. https://github.com/curl/curl/issues/7268
  329. 1.32 add asynch getaddrinfo support
  330. Use getaddrinfo_a() to provide an asynch name resolver backend to libcurl
  331. that does not use threads and does not depend on c-ares. The getaddrinfo_a
  332. function is (probably?) glibc specific but that is a widely used libc among
  333. our users.
  334. https://github.com/curl/curl/pull/6746
  335. 1.33 make DoH inherit more transfer properties
  336. Some options are not inherited because they are not relevant for the DoH SSL
  337. connections, or inheriting the option may result in unexpected behavior. For
  338. example the user's debug function callback is not inherited because it would
  339. be unexpected for internal handles (ie DoH handles) to be passed to that
  340. callback.
  341. If an option is not inherited then it is not possible to set it separately
  342. for DoH without a DoH-specific option. For example:
  343. CURLOPT_DOH_SSL_VERIFYHOST, CURLOPT_DOH_SSL_VERIFYPEER and
  344. CURLOPT_DOH_SSL_VERIFYSTATUS.
  345. See https://github.com/curl/curl/issues/6605
  346. 2. libcurl - multi interface
  347. 2.1 More non-blocking
  348. Make sure we do not ever loop because of non-blocking sockets returning
  349. EWOULDBLOCK or similar. Blocking cases include:
  350. - Name resolves on non-windows unless c-ares or the threaded resolver is used.
  351. - The threaded resolver may block on cleanup:
  352. https://github.com/curl/curl/issues/4852
  353. - file:// transfers
  354. - TELNET transfers
  355. - GSSAPI authentication for FTP transfers
  356. - The "DONE" operation (post transfer protocol-specific actions) for the
  357. protocols SFTP, SMTP, FTP. Fixing multi_done() for this is a worthy task.
  358. - curl_multi_remove_handle for any of the above. See section 2.3.
  359. 2.2 Better support for same name resolves
  360. If a name resolve has been initiated for name NN and a second easy handle
  361. wants to resolve that name as well, make it wait for the first resolve to end
  362. up in the cache instead of doing a second separate resolve. This is
  363. especially needed when adding many simultaneous handles using the same host
  364. name when the DNS resolver can get flooded.
  365. 2.3 Non-blocking curl_multi_remove_handle()
  366. The multi interface has a few API calls that assume a blocking behavior, like
  367. add_handle() and remove_handle() which limits what we can do internally. The
  368. multi API need to be moved even more into a single function that "drives"
  369. everything in a non-blocking manner and signals when something is done. A
  370. remove or add would then only ask for the action to get started and then
  371. multi_perform() etc still be called until the add/remove is completed.
  372. 2.4 Split connect and authentication process
  373. The multi interface treats the authentication process as part of the connect
  374. phase. As such any failures during authentication does not trigger the
  375. relevant QUIT or LOGOFF for protocols such as IMAP, POP3 and SMTP.
  376. 2.5 Edge-triggered sockets should work
  377. The multi_socket API should work with edge-triggered socket events. One of
  378. the internal actions that need to be improved for this to work perfectly is
  379. the 'maxloops' handling in transfer.c:readwrite_data().
  380. 2.6 multi upkeep
  381. In libcurl 7.62.0 we introduced curl_easy_upkeep. It unfortunately only works
  382. on easy handles. We should introduces a version of that for the multi handle,
  383. and also consider doing "upkeep" automatically on connections in the
  384. connection pool when the multi handle is in used.
  385. See https://github.com/curl/curl/issues/3199
  386. 2.7 Virtual external sockets
  387. libcurl performs operations on the given file descriptor that presumes it is
  388. a socket and an application cannot replace them at the moment. Allowing an
  389. application to fully replace those would allow a larger degree of freedom and
  390. flexibility.
  391. See https://github.com/curl/curl/issues/5835
  392. 2.8 dynamically decide to use socketpair
  393. For users who do not use curl_multi_wait() or do not care for
  394. curl_multi_wakeup(), we could introduce a way to make libcurl NOT
  395. create a socketpair in the multi handle.
  396. See https://github.com/curl/curl/issues/4829
  397. 3. Documentation
  398. 3.1 Improve documentation about fork safety
  399. See https://github.com/curl/curl/issues/6968
  400. 3.2 Provide cmake config-file
  401. A config-file package is a set of files provided by us to allow applications
  402. to write cmake scripts to find and use libcurl easier. See
  403. https://github.com/curl/curl/issues/885
  404. 4. FTP
  405. 4.1 HOST
  406. HOST is a command for a client to tell which hostname to use, to offer FTP
  407. servers named-based virtual hosting:
  408. https://datatracker.ietf.org/doc/html/rfc7151
  409. 4.2 Alter passive/active on failure and retry
  410. When trying to connect passively to a server which only supports active
  411. connections, libcurl returns CURLE_FTP_WEIRD_PASV_REPLY and closes the
  412. connection. There could be a way to fallback to an active connection (and
  413. vice versa). https://curl.se/bug/feature.cgi?id=1754793
  414. 4.4 Support CURLOPT_PREQUOTE for directions listings
  415. The lack of support is mostly an oversight and requires the FTP state machine
  416. to get updated to get fixed.
  417. https://github.com/curl/curl/issues/8602
  418. 4.5 ASCII support
  419. FTP ASCII transfers do not follow RFC 959. They do not convert the data
  420. accordingly.
  421. 4.6 GSSAPI via Windows SSPI
  422. In addition to currently supporting the SASL GSSAPI mechanism (Kerberos V5)
  423. via third-party GSS-API libraries, such as Heimdal or MIT Kerberos, also add
  424. support for GSSAPI authentication via Windows SSPI.
  425. 4.7 STAT for LIST without data connection
  426. Some FTP servers allow STAT for listing directories instead of using LIST,
  427. and the response is then sent over the control connection instead of as the
  428. otherwise usedw data connection: https://www.nsftools.com/tips/RawFTP.htm#STAT
  429. This is not detailed in any FTP specification.
  430. 4.8 Passive transfer could try other IP addresses
  431. When doing FTP operations through a proxy at localhost, the reported spotted
  432. that curl only tried to connect once to the proxy, while it had multiple
  433. addresses and a failed connect on one address should make it try the next.
  434. After switching to passive mode (EPSV), curl could try all IP addresses for
  435. "localhost". Currently it tries ::1, but it should also try 127.0.0.1.
  436. See https://github.com/curl/curl/issues/1508
  437. 5. HTTP
  438. 5.1 Provide the error body from a CONNECT response
  439. When curl receives a body response from a CONNECT request to a proxy, it
  440. always just reads and ignores it. It would make some users happy if curl
  441. instead optionally would be able to make that responsible available. Via a
  442. new callback? Through some other means?
  443. See https://github.com/curl/curl/issues/9513
  444. 5.2 Obey Retry-After in redirects
  445. The Retry-After is said to dicate "the minimum time that the user agent is
  446. asked to wait before issuing the redirected request" and libcurl does not
  447. obey this.
  448. See https://github.com/curl/curl/issues/11447
  449. 5.3 Rearrange request header order
  450. Server implementers often make an effort to detect browser and to reject
  451. clients it can detect to not match. One of the last details we cannot yet
  452. control in libcurl's HTTP requests, which also can be exploited to detect
  453. that libcurl is in fact used even when it tries to impersonate a browser, is
  454. the order of the request headers. I propose that we introduce a new option in
  455. which you give headers a value, and then when the HTTP request is built it
  456. sorts the headers based on that number. We could then have internally created
  457. headers use a default value so only headers that need to be moved have to be
  458. specified.
  459. 5.4 Allow SAN names in HTTP/2 server push
  460. curl only allows HTTP/2 push promise if the provided :authority header value
  461. exactly matches the hostname given in the URL. It could be extended to allow
  462. any name that would match the Subject Alternative Names in the server's TLS
  463. certificate.
  464. See https://github.com/curl/curl/pull/3581
  465. 5.5 auth= in URLs
  466. Add the ability to specify the preferred authentication mechanism to use by
  467. using ;auth=<mech> in the login part of the URL.
  468. For example:
  469. http://test:pass;auth=NTLM@example.com would be equivalent to specifying
  470. --user test:pass;auth=NTLM or --user test:pass --ntlm from the command line.
  471. Additionally this should be implemented for proxy base URLs as well.
  472. 5.6 alt-svc should fallback if alt-svc does not work
  473. The alt-svc: header provides a set of alternative services for curl to use
  474. instead of the original. If the first attempted one fails, it should try the
  475. next etc and if all alternatives fail go back to the original.
  476. See https://github.com/curl/curl/issues/4908
  477. 5.7 Require HTTP version X or higher
  478. curl and libcurl provide options for trying higher HTTP versions (for example
  479. HTTP/2) but then still allows the server to pick version 1.1. We could
  480. consider adding a way to require a minimum version.
  481. See https://github.com/curl/curl/issues/7980
  482. 6. TELNET
  483. 6.1 ditch stdin
  484. Reading input (to send to the remote server) on stdin is a crappy solution
  485. for library purposes. We need to invent a good way for the application to be
  486. able to provide the data to send.
  487. 6.2 ditch telnet-specific select
  488. Move the telnet support's network select() loop go away and merge the code
  489. into the main transfer loop. Until this is done, the multi interface does not
  490. work for telnet.
  491. 6.3 feature negotiation debug data
  492. Add telnet feature negotiation data to the debug callback as header data.
  493. 6.4 exit immediately upon connection if stdin is /dev/null
  494. If it did, curl could be used to probe if there is an server there listening
  495. on a specific port. That is, the following command would exit immediately
  496. after the connection is established with exit code 0:
  497. curl -s --connect-timeout 2 telnet://example.com:80 </dev/null
  498. 7. SMTP
  499. 7.1 Passing NOTIFY option to CURLOPT_MAIL_RCPT
  500. Is there a way to pass the NOTIFY option to the CURLOPT_MAIL_RCPT option ? I
  501. set a string that already contains a bracket. For instance something like
  502. that: curl_slist_append( recipients, "<foo@bar> NOTIFY=SUCCESS,FAILURE" );
  503. https://github.com/curl/curl/issues/8232
  504. 7.2 Enhanced capability support
  505. Add the ability, for an application that uses libcurl, to obtain the list of
  506. capabilities returned from the EHLO command.
  507. 7.3 Add CURLOPT_MAIL_CLIENT option
  508. Rather than use the URL to specify the mail client string to present in the
  509. HELO and EHLO commands, libcurl should support a new CURLOPT specifically for
  510. specifying this data as the URL is non-standard and to be honest a bit of a
  511. hack ;-)
  512. Please see the following thread for more information:
  513. https://curl.se/mail/lib-2012-05/0178.html
  514. 8. POP3
  515. 8.2 Enhanced capability support
  516. Add the ability, for an application that uses libcurl, to obtain the list of
  517. capabilities returned from the CAPA command.
  518. 9. IMAP
  519. 9.1 Enhanced capability support
  520. Add the ability, for an application that uses libcurl, to obtain the list of
  521. capabilities returned from the CAPABILITY command.
  522. 10. LDAP
  523. 10.1 SASL based authentication mechanisms
  524. Currently the LDAP module only supports ldap_simple_bind_s() in order to bind
  525. to an LDAP server. However, this function sends username and password details
  526. using the simple authentication mechanism (as clear text). However, it should
  527. be possible to use ldap_bind_s() instead specifying the security context
  528. information ourselves.
  529. 10.2 CURLOPT_SSL_CTX_FUNCTION for LDAPS
  530. CURLOPT_SSL_CTX_FUNCTION works perfectly for HTTPS and email protocols, but
  531. it has no effect for LDAPS connections.
  532. https://github.com/curl/curl/issues/4108
  533. 10.3 Paged searches on LDAP server
  534. https://github.com/curl/curl/issues/4452
  535. 10.4 Certificate-Based Authentication
  536. LDAPS not possible with MAC and Windows with Certificate-Based Authentication
  537. https://github.com/curl/curl/issues/9641
  538. 11. SMB
  539. 11.1 File listing support
  540. Add support for listing the contents of a SMB share. The output should
  541. probably be the same as/similar to FTP.
  542. 11.2 Honor file timestamps
  543. The timestamp of the transferred file should reflect that of the original
  544. file.
  545. 11.3 Use NTLMv2
  546. Currently the SMB authentication uses NTLMv1.
  547. 11.4 Create remote directories
  548. Support for creating remote directories when uploading a file to a directory
  549. that does not exist on the server, just like --ftp-create-dirs.
  550. 12. FILE
  551. 12.1 Directory listing on non-POSIX
  552. Listing the contents of a directory accessed with FILE only works on
  553. platforms with opendir. Support could be added for more systems, like
  554. Windows.
  555. 13. TLS
  556. 13.1 TLS-PSK with OpenSSL
  557. Transport Layer Security pre-shared key ciphersuites (TLS-PSK) is a set of
  558. cryptographic protocols that provide secure communication based on pre-shared
  559. keys (PSKs). These pre-shared keys are symmetric keys shared in advance among
  560. the communicating parties.
  561. https://github.com/curl/curl/issues/5081
  562. 13.2 TLS channel binding
  563. TLS 1.2 and 1.3 provide the ability to extract some secret data from the TLS
  564. connection and use it in the client request (usually in some sort of
  565. authentication) to ensure that the data sent is bound to the specific TLS
  566. connection and cannot be successfully intercepted by a proxy. This
  567. functionality can be used in a standard authentication mechanism such as
  568. GSS-API or SCRAM, or in custom approaches like custom HTTP Authentication
  569. headers.
  570. For TLS 1.2, the binding type is usually tls-unique, and for TLS 1.3 it is
  571. tls-exporter.
  572. https://datatracker.ietf.org/doc/html/rfc5929
  573. https://datatracker.ietf.org/doc/html/rfc9266
  574. https://github.com/curl/curl/issues/9226
  575. 13.3 Defeat TLS fingerprinting
  576. By changing the order of TLS extensions provided in the TLS handshake, it is
  577. sometimes possible to circumvent TLS fingerprinting by servers. The TLS
  578. extension order is of course not the only way to fingerprint a client.
  579. See https://github.com/curl/curl/issues/8119
  580. 13.5 Export session ids
  581. Add an interface to libcurl that enables "session IDs" to get
  582. exported/imported. Cris Bailiff said: "OpenSSL has functions which can
  583. serialise the current SSL state to a buffer of your choice, and recover/reset
  584. the state from such a buffer at a later date - this is used by mod_ssl for
  585. apache to implement and SSL session ID cache".
  586. 13.6 Provide callback for cert verification
  587. OpenSSL supports a callback for customised verification of the peer
  588. certificate, but this does not seem to be exposed in the libcurl APIs. Could
  589. it be? There is so much that could be done if it were.
  590. 13.7 Less memory massaging with Schannel
  591. The Schannel backend does a lot of custom memory management we would rather
  592. avoid: the repeated alloc + free in sends and the custom memory + realloc
  593. system for encrypted and decrypted data. That should be avoided and reduced
  594. for 1) efficiency and 2) safety.
  595. 13.8 Support DANE
  596. DNS-Based Authentication of Named Entities (DANE) is a way to provide SSL
  597. keys and certs over DNS using DNSSEC as an alternative to the CA model.
  598. https://www.rfc-editor.org/rfc/rfc6698.txt
  599. An initial patch was posted by Suresh Krishnaswamy on March 7th 2013
  600. (https://curl.se/mail/lib-2013-03/0075.html) but it was a too simple
  601. approach. See Daniel's comments:
  602. https://curl.se/mail/lib-2013-03/0103.html . libunbound may be the
  603. correct library to base this development on.
  604. Björn Stenberg wrote a separate initial take on DANE that was never
  605. completed.
  606. 13.9 TLS record padding
  607. TLS (1.3) offers optional record padding and OpenSSL provides an API for it.
  608. I could make sense for libcurl to offer this ability to applications to make
  609. traffic patterns harder to figure out by network traffic observers.
  610. See https://github.com/curl/curl/issues/5398
  611. 13.10 Support Authority Information Access certificate extension (AIA)
  612. AIA can provide various things like CRLs but more importantly information
  613. about intermediate CA certificates that can allow validation path to be
  614. fulfilled when the HTTPS server does not itself provide them.
  615. Since AIA is about downloading certs on demand to complete a TLS handshake,
  616. it is probably a bit tricky to get done right.
  617. See https://github.com/curl/curl/issues/2793
  618. 13.11 Some TLS options are not offered for HTTPS proxies
  619. Some TLS related options to the command line tool and libcurl are only
  620. provided for the server and not for HTTPS proxies. --proxy-tls-max,
  621. --proxy-tlsv1.3, --proxy-curves and a few more.
  622. For more Documentation on this see:
  623. https://curl.se/libcurl/c/tls-options.html
  624. https://github.com/curl/curl/issues/12286
  625. 13.13 Make sure we forbid TLS 1.3 post-handshake authentication
  626. RFC 8740 explains how using HTTP/2 must forbid the use of TLS 1.3
  627. post-handshake authentication. We should make sure to live up to that.
  628. See https://github.com/curl/curl/issues/5396
  629. 13.14 Support the clienthello extension
  630. Certain stupid networks and middle boxes have a problem with SSL handshake
  631. packets that are within a certain size range because how that sets some bits
  632. that previously (in older TLS version) were not set. The clienthello
  633. extension adds padding to avoid that size range.
  634. https://datatracker.ietf.org/doc/html/rfc7685
  635. https://github.com/curl/curl/issues/2299
  636. 13.15 Select signature algorithms
  637. Consider adding an option or a way for users to select TLS signature
  638. algorithm. The signature algorithms set by a client are used directly in the
  639. supported signature algorithm in the client hello message.
  640. https://github.com/curl/curl/issues/12982
  641. 13.16 Share the CA cache
  642. For TLS backends that supports CA caching, it makes sense to allow the share
  643. object to be used to store the CA cache as well via the share API. Would
  644. allow multiple easy handles to reuse the CA cache and save themselves from a
  645. lot of extra processing overhead.
  646. 13.17 Add missing features to TLS backends
  647. The feature matrix at https://curl.se/libcurl/c/tls-options.html shows which
  648. features are supported by which TLS backends, and thus also where there are
  649. feature gaps.
  650. 14. GnuTLS
  651. 14.2 check connection
  652. Add a way to check if the connection seems to be alive, to correspond to the
  653. SSL_peak() way we use with OpenSSL.
  654. 15. Schannel
  655. 15.1 Extend support for client certificate authentication
  656. The existing support for the -E/--cert and --key options could be
  657. extended by supplying a custom certificate and key in PEM format, see:
  658. - Getting a Certificate for Schannel
  659. https://msdn.microsoft.com/en-us/library/windows/desktop/aa375447.aspx
  660. 15.2 Extend support for the --ciphers option
  661. The existing support for the --ciphers option could be extended
  662. by mapping the OpenSSL/GnuTLS cipher suites to the Schannel APIs, see
  663. - Specifying Schannel Ciphers and Cipher Strengths
  664. https://msdn.microsoft.com/en-us/library/windows/desktop/aa380161.aspx
  665. 15.4 Add option to allow abrupt server closure
  666. libcurl w/schannel errors without a known termination point from the server
  667. (such as length of transfer, or SSL "close notify" alert) to prevent against
  668. a truncation attack. Really old servers may neglect to send any termination
  669. point. An option could be added to ignore such abrupt closures.
  670. https://github.com/curl/curl/issues/4427
  671. 16. SASL
  672. 16.1 Other authentication mechanisms
  673. Add support for other authentication mechanisms such as OLP,
  674. GSS-SPNEGO and others.
  675. 16.2 Add QOP support to GSSAPI authentication
  676. Currently the GSSAPI authentication only supports the default QOP of auth
  677. (Authentication), whilst Kerberos V5 supports both auth-int (Authentication
  678. with integrity protection) and auth-conf (Authentication with integrity and
  679. privacy protection).
  680. 17. SSH protocols
  681. 17.1 Multiplexing
  682. SSH is a perfectly fine multiplexed protocols which would allow libcurl to do
  683. multiple parallel transfers from the same host using the same connection,
  684. much in the same spirit as HTTP/2 does. libcurl however does not take
  685. advantage of that ability but does instead always create a new connection for
  686. new transfers even if an existing connection already exists to the host.
  687. To fix this, libcurl would have to detect an existing connection and "attach"
  688. the new transfer to the existing one.
  689. 17.2 Handle growing SFTP files
  690. The SFTP code in libcurl checks the file size *before* a transfer starts and
  691. then proceeds to transfer exactly that amount of data. If the remote file
  692. grows while the transfer is in progress libcurl does not notice and does not
  693. adapt. The OpenSSH SFTP command line tool does and libcurl could also just
  694. attempt to download more to see if there is more to get...
  695. https://github.com/curl/curl/issues/4344
  696. 17.3 Read keys from ~/.ssh/id_ecdsa, id_ed25519
  697. The libssh2 backend in curl is limited to only reading keys from id_rsa and
  698. id_dsa, which makes it fail connecting to servers that use more modern key
  699. types.
  700. https://github.com/curl/curl/issues/8586
  701. 17.4 Support CURLOPT_PREQUOTE
  702. The two other QUOTE options are supported for SFTP, but this was left out for
  703. unknown reasons.
  704. 17.5 SSH over HTTPS proxy with more backends
  705. The SSH based protocols SFTP and SCP did not work over HTTPS proxy at
  706. all until PR https://github.com/curl/curl/pull/6021 brought the
  707. functionality with the libssh2 backend. Presumably, this support
  708. can/could be added for the other backends as well.
  709. 17.6 SFTP with SCP://
  710. OpenSSH 9 switched their 'scp' tool to speak SFTP under the hood. Going
  711. forward it might be worth having curl or libcurl attempt SFTP if SCP fails to
  712. follow suite.
  713. 18. Command line tool
  714. 18.1 sync
  715. "curl --sync http://example.com/feed[1-100].rss" or
  716. "curl --sync http://example.net/{index,calendar,history}.html"
  717. Downloads a range or set of URLs using the remote name, but only if the
  718. remote file is newer than the local file. A Last-Modified HTTP date header
  719. should also be used to set the mod date on the downloaded file.
  720. 18.2 glob posts
  721. Globbing support for -d and -F, as in 'curl -d "name=foo[0-9]" URL'.
  722. This is easily scripted though.
  723. 18.3 -h option
  724. Support "curl -h --insecure" etc to output the manpage section for the
  725. --insecure command line option in the terminal. Should be possible to work
  726. with either long or short versions of command line options.
  727. 18.4 --proxycommand
  728. Allow the user to make curl run a command and use its stdio to make requests
  729. and not do any network connection by itself. Example:
  730. curl --proxycommand 'ssh pi@raspberrypi.local -W 10.1.1.75 80' \
  731. http://some/otherwise/unavailable/service.php
  732. See https://github.com/curl/curl/issues/4941
  733. 18.5 UTF-8 filenames in Content-Disposition
  734. RFC 6266 documents how UTF-8 names can be passed to a client in the
  735. Content-Disposition header, and curl does not support this.
  736. https://github.com/curl/curl/issues/1888
  737. 18.6 Option to make -Z merge lined based outputs on stdout
  738. When a user requests multiple lined based files using -Z and sends them to
  739. stdout, curl does not "merge" and send complete lines fine but may send
  740. partial lines from several sources.
  741. https://github.com/curl/curl/issues/5175
  742. 18.7 specify which response codes that make -f/--fail return error
  743. Allows a user to better specify exacly which error code(s) that are fine
  744. and which are errors for their specific uses cases
  745. 18.9 Choose the name of file in braces for complex URLs
  746. When using braces to download a list of URLs and you use complicated names
  747. in the list of alternatives, it could be handy to allow curl to use other
  748. names when saving.
  749. Consider a way to offer that. Possibly like
  750. {partURL1:name1,partURL2:name2,partURL3:name3} where the name following the
  751. colon is the output name.
  752. See https://github.com/curl/curl/issues/221
  753. 18.10 improve how curl works in a windows console window
  754. If you pull the scrollbar when transferring with curl in a Windows console
  755. window, the transfer is interrupted and can get disconnected. This can
  756. probably be improved. See https://github.com/curl/curl/issues/322
  757. 18.11 Windows: set attribute 'archive' for completed downloads
  758. The archive bit (FILE_ATTRIBUTE_ARCHIVE, 0x20) separates files that shall be
  759. backed up from those that are either not ready or have not changed.
  760. Downloads in progress are neither ready to be backed up, nor should they be
  761. opened by a different process. Only after a download has been completed it is
  762. sensible to include it in any integer snapshot or backup of the system.
  763. See https://github.com/curl/curl/issues/3354
  764. 18.12 keep running, read instructions from pipe/socket
  765. Provide an option that makes curl not exit after the last URL (or even work
  766. without a given URL), and then make it read instructions passed on a pipe or
  767. over a socket to make further instructions so that a second subsequent curl
  768. invoke can talk to the still running instance and ask for transfers to get
  769. done, and thus maintain its connection pool, DNS cache and more.
  770. 18.13 Acknowledge Ratelimit headers
  771. Consider a command line option that can make curl do multiple serial requests
  772. while acknowledging server specified rate limits:
  773. https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/
  774. See https://github.com/curl/curl/issues/5406
  775. 18.14 --dry-run
  776. A command line option that makes curl show exactly what it would do and send
  777. if it would run for real.
  778. See https://github.com/curl/curl/issues/5426
  779. 18.15 --retry should resume
  780. When --retry is used and curl actually retries transfer, it should use the
  781. already transferred data and do a resumed transfer for the rest (when
  782. possible) so that it does not have to transfer the same data again that was
  783. already transferred before the retry.
  784. See https://github.com/curl/curl/issues/1084
  785. 18.16 send only part of --data
  786. When the user only wants to send a small piece of the data provided with
  787. --data or --data-binary, like when that data is a huge file, consider a way
  788. to specify that curl should only send a piece of that. One suggested syntax
  789. would be: "--data-binary @largefile.zip!1073741823-2147483647".
  790. See https://github.com/curl/curl/issues/1200
  791. 18.17 consider filename from the redirected URL with -O ?
  792. When a user gives a URL and uses -O, and curl follows a redirect to a new
  793. URL, the filename is not extracted and used from the newly redirected-to URL
  794. even if the new URL may have a much more sensible filename.
  795. This is clearly documented and helps for security since there is no surprise
  796. to users which filename that might get overwritten, but maybe a new option
  797. could allow for this or maybe -J should imply such a treatment as well as -J
  798. already allows for the server to decide what filename to use so it already
  799. provides the "may overwrite any file" risk.
  800. This is extra tricky if the original URL has no filename part at all since
  801. then the current code path does error out with an error message, and we
  802. cannot *know* already at that point if curl is redirected to a URL that has a
  803. filename...
  804. See https://github.com/curl/curl/issues/1241
  805. 18.18 retry on network is unreachable
  806. The --retry option retries transfers on "transient failures". We later added
  807. --retry-connrefused to also retry for "connection refused" errors.
  808. Suggestions have been brought to also allow retry on "network is unreachable"
  809. errors and while totally reasonable, maybe we should consider a way to make
  810. this more configurable than to add a new option for every new error people
  811. want to retry for?
  812. https://github.com/curl/curl/issues/1603
  813. 18.19 expand ~/ in config files
  814. For example .curlrc could benefit from being able to do this.
  815. See https://github.com/curl/curl/issues/2317
  816. 18.20 hostname sections in config files
  817. config files would be more powerful if they could set different
  818. configurations depending on used URLs, hostname or possibly origin. Then a
  819. default .curlrc could a specific user-agent only when doing requests against
  820. a certain site.
  821. 18.21 retry on the redirected-to URL
  822. When curl is told to --retry a failed transfer and follows redirects, it
  823. might get an HTTP 429 response from the redirected-to URL and not the
  824. original one, which then could make curl decide to rather retry the transfer
  825. on that URL only instead of the original operation to the original URL.
  826. Perhaps extra emphasized if the original transfer is a large POST that
  827. redirects to a separate GET, and that GET is what gets the 529
  828. See https://github.com/curl/curl/issues/5462
  829. 18.23 Set the modification date on an uploaded file
  830. For SFTP and possibly FTP, curl could offer an option to set the
  831. modification time for the uploaded file.
  832. See https://github.com/curl/curl/issues/5768
  833. 18.24 Use multiple parallel transfers for a single download
  834. To enhance transfer speed, downloading a single URL can be split up into
  835. multiple separate range downloads that get combined into a single final
  836. result.
  837. An ideal implementation would not use a specified number of parallel
  838. transfers, but curl could:
  839. - First start getting the full file as transfer A
  840. - If after N seconds have passed and the transfer is expected to continue for
  841. M seconds or more, add a new transfer (B) that asks for the second half of
  842. A's content (and stop A at the middle).
  843. - If splitting up the work improves the transfer rate, it could then be done
  844. again. Then again, etc up to a limit.
  845. This way, if transfer B fails (because Range: is not supported) it lets
  846. transfer A remain the single one. N and M could be set to some sensible
  847. defaults.
  848. See https://github.com/curl/curl/issues/5774
  849. 18.25 Prevent terminal injection when writing to terminal
  850. curl could offer an option to make escape sequence either non-functional or
  851. avoid cursor moves or similar to reduce the risk of a user getting tricked by
  852. clever tricks.
  853. See https://github.com/curl/curl/issues/6150
  854. 18.26 Custom progress meter update interval
  855. Users who are for example doing large downloads in CI or remote setups might
  856. want the occasional progress meter update to see that the transfer is
  857. progressing and has not stuck, but they may not appreciate the
  858. many-times-a-second frequency curl can end up doing it with now.
  859. 18.27 -J and -O with %-encoded filenames
  860. -J/--remote-header-name does not decode %-encoded filenames. RFC 6266 details
  861. how it should be done. The can of worm is basically that we have no charset
  862. handling in curl and ascii >=128 is a challenge for us. Not to mention that
  863. decoding also means that we need to check for nastiness that is attempted,
  864. like "../" sequences and the like. Probably everything to the left of any
  865. embedded slashes should be cut off.
  866. https://curl.se/bug/view.cgi?id=1294
  867. -O also does not decode %-encoded names, and while it has even less
  868. information about the charset involved the process is similar to the -J case.
  869. Note that we do not decode -O without the user asking for it with some other
  870. means, since -O has always been documented to use the name exactly as
  871. specified in the URL.
  872. 18.28 -J with -C -
  873. When using -J (with -O), automatically resumed downloading together with "-C
  874. -" fails. Without -J the same command line works. This happens because the
  875. resume logic is worked out before the target filename (and thus its
  876. pre-transfer size) has been figured out. This can be improved.
  877. https://curl.se/bug/view.cgi?id=1169
  878. 18.29 --retry and transfer timeouts
  879. If using --retry and the transfer timeouts (possibly due to using -m or
  880. -y/-Y) the next attempt does not resume the transfer properly from what was
  881. downloaded in the previous attempt but truncates and restarts at the original
  882. position where it was at before the previous failed attempt. See
  883. https://curl.se/mail/lib-2008-01/0080.html and Mandriva bug report
  884. https://qa.mandriva.com/show_bug.cgi?id=22565
  885. 19. Build
  886. 19.2 Enable PIE and RELRO by default
  887. Especially when having programs that execute curl via the command line, PIE
  888. renders the exploitation of memory corruption vulnerabilities a lot more
  889. difficult. This can be attributed to the additional information leaks being
  890. required to conduct a successful attack. RELRO, on the other hand, masks
  891. different binary sections like the GOT as read-only and thus kills a handful
  892. of techniques that come in handy when attackers are able to arbitrarily
  893. overwrite memory. A few tests showed that enabling these features had close
  894. to no impact, neither on the performance nor on the general functionality of
  895. curl.
  896. 19.3 Do not use GNU libtool on OpenBSD
  897. When compiling curl on OpenBSD with "--enable-debug" it gives linking errors
  898. when you use GNU libtool. This can be fixed by using the libtool provided by
  899. OpenBSD itself. However for this the user always needs to invoke make with
  900. "LIBTOOL=/usr/bin/libtool". It would be nice if the script could have some
  901. magic to detect if this system is an OpenBSD host and then use the OpenBSD
  902. libtool instead.
  903. See https://github.com/curl/curl/issues/5862
  904. 19.4 Package curl for Windows in a signed installer
  905. See https://github.com/curl/curl/issues/5424
  906. 19.5 make configure use --cache-file more and better
  907. The configure script can be improved to cache more values so that repeated
  908. invokes run much faster.
  909. See https://github.com/curl/curl/issues/7753
  910. 19.6 build curl with Windows Unicode support
  911. The user wants an easier way to tell autotools to build curl with Windows
  912. Unicode support, like ./configure --enable-windows-unicode
  913. See https://github.com/curl/curl/issues/7229
  914. 20. Test suite
  915. 20.1 SSL tunnel
  916. Make our own version of stunnel for simple port forwarding to enable HTTPS
  917. and FTP-SSL tests without the stunnel dependency, and it could allow us to
  918. provide test tools built with either OpenSSL or GnuTLS
  919. 20.2 nicer lacking perl message
  920. If perl was not found by the configure script, do not attempt to run the tests
  921. but explain something nice why it does not.
  922. 20.3 more protocols supported
  923. Extend the test suite to include more protocols. The telnet could just do FTP
  924. or http operations (for which we have test servers).
  925. 20.4 more platforms supported
  926. Make the test suite work on more platforms. OpenBSD and Mac OS. Remove
  927. fork()s and it should become even more portable.
  928. 20.6 Use the RFC 6265 test suite
  929. A test suite made for HTTP cookies (RFC 6265) by Adam Barth is available at
  930. https://github.com/abarth/http-state/tree/master/tests
  931. It would be good if someone would write a script/setup that would run curl
  932. with that test suite and detect deviances. Ideally, that would even be
  933. incorporated into our regular test suite.
  934. 20.8 Run web-platform-tests URL tests
  935. Run web-platform-tests URL tests and compare results with browsers on wpt.fyi
  936. It would help us find issues to fix and help us document where our parser
  937. differs from the WHATWG URL spec parsers.
  938. See https://github.com/curl/curl/issues/4477
  939. 21. MQTT
  940. 21.1 Support rate-limiting
  941. The rate-limiting logic is done in the PERFORMING state in multi.c but MQTT
  942. is not (yet) implemented to use that.
  943. 21.2 Support MQTTS
  944. 22. TFTP
  945. 22.1 TFTP does not convert LF to CRLF for mode=netascii
  946. RFC 3617 defines that an TFTP transfer can be done using "netascii"
  947. mode. curl does not support extracting that mode from the URL nor does it treat
  948. such transfers specifically. It should probably do LF to CRLF translations
  949. for them.
  950. See https://github.com/curl/curl/issues/12655