TODO 50 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385
  1. _ _ ____ _
  2. ___| | | | _ \| |
  3. / __| | | | |_) | |
  4. | (__| |_| | _ <| |___
  5. \___|\___/|_| \_\_____|
  6. Things that could be nice to do in the future
  7. Things to do in project curl. Please tell us what you think, contribute and
  8. send us patches that improve things.
  9. Be aware that these are things that we could do, or have once been considered
  10. things we could do. If you want to work on any of these areas, please
  11. consider bringing it up for discussions first on the mailing list so that we
  12. all agree it is still a good idea for the project.
  13. All bugs documented in the KNOWN_BUGS document are subject for fixing.
  14. 1. libcurl
  15. 1.1 TFO support on Windows
  16. 1.2 Consult %APPDATA% also for .netrc
  17. 1.3 struct lifreq
  18. 1.4 alt-svc sharing
  19. 1.5 get rid of PATH_MAX
  20. 1.6 native IDN support on macOS
  21. 1.8 CURLOPT_RESOLVE for any port number
  22. 1.9 Cache negative name resolves
  23. 1.10 auto-detect proxy
  24. 1.11 minimize dependencies with dynamically loaded modules
  25. 1.12 updated DNS server while running
  26. 1.13 c-ares and CURLOPT_OPENSOCKETFUNCTION
  27. 1.15 Monitor connections in the connection pool
  28. 1.16 Try to URL encode given URL
  29. 1.17 Add support for IRIs
  30. 1.18 try next proxy if one does not work
  31. 1.19 provide timing info for each redirect
  32. 1.20 SRV and URI DNS records
  33. 1.21 netrc caching and sharing
  34. 1.22 CURLINFO_PAUSE_STATE
  35. 1.23 Offer API to flush the connection pool
  36. 1.25 Expose tried IP addresses that failed
  37. 1.28 FD_CLOEXEC
  38. 1.29 WebSocket read callback
  39. 1.30 config file parsing
  40. 1.31 erase secrets from heap/stack after use
  41. 1.32 add asynch getaddrinfo support
  42. 1.33 make DoH inherit more transfer properties
  43. 2. libcurl - multi interface
  44. 2.1 More non-blocking
  45. 2.2 Better support for same name resolves
  46. 2.3 Non-blocking curl_multi_remove_handle()
  47. 2.4 Split connect and authentication process
  48. 2.5 Edge-triggered sockets should work
  49. 2.6 multi upkeep
  50. 2.7 Virtual external sockets
  51. 2.8 dynamically decide to use socketpair
  52. 3. Documentation
  53. 3.1 Improve documentation about fork safety
  54. 3.2 Provide cmake config-file
  55. 4. FTP
  56. 4.1 HOST
  57. 4.2 Alter passive/active on failure and retry
  58. 4.3 Earlier bad letter detection
  59. 4.4 Support CURLOPT_PREQUOTE for dir listings too
  60. 4.5 ASCII support
  61. 4.6 GSSAPI via Windows SSPI
  62. 4.7 STAT for LIST without data connection
  63. 4.8 Passive transfer could try other IP addresses
  64. 5. HTTP
  65. 5.1 Provide the error body from a CONNECT response
  66. 5.2 Obey Retry-After in redirects
  67. 5.3 Rearrange request header order
  68. 5.4 Allow SAN names in HTTP/2 server push
  69. 5.5 auth= in URLs
  70. 5.6 alt-svc should fallback if alt-svc does not work
  71. 5.7 Require HTTP version X or higher
  72. 6. TELNET
  73. 6.1 ditch stdin
  74. 6.2 ditch telnet-specific select
  75. 6.3 feature negotiation debug data
  76. 6.4 exit immediately upon connection if stdin is /dev/null
  77. 7. SMTP
  78. 7.1 Passing NOTIFY option to CURLOPT_MAIL_RCPT
  79. 7.2 Enhanced capability support
  80. 7.3 Add CURLOPT_MAIL_CLIENT option
  81. 8. POP3
  82. 8.2 Enhanced capability support
  83. 9. IMAP
  84. 9.1 Enhanced capability support
  85. 10. LDAP
  86. 10.1 SASL based authentication mechanisms
  87. 10.2 CURLOPT_SSL_CTX_FUNCTION for LDAPS
  88. 10.3 Paged searches on LDAP server
  89. 10.4 Certificate-Based Authentication
  90. 11. SMB
  91. 11.1 File listing support
  92. 11.2 Honor file timestamps
  93. 11.3 Use NTLMv2
  94. 11.4 Create remote directories
  95. 12. FILE
  96. 12.1 Directory listing for FILE:
  97. 13. TLS
  98. 13.1 TLS-PSK with OpenSSL
  99. 13.2 Provide mutex locking API
  100. 13.3 Defeat TLS fingerprinting
  101. 13.4 Cache/share OpenSSL contexts
  102. 13.5 Export session ids
  103. 13.6 Provide callback for cert verification
  104. 13.7 Less memory massaging with Schannel
  105. 13.8 Support DANE
  106. 13.9 TLS record padding
  107. 13.10 Support Authority Information Access certificate extension (AIA)
  108. 13.12 Reduce CA certificate bundle reparsing
  109. 13.13 Make sure we forbid TLS 1.3 post-handshake authentication
  110. 13.14 Support the clienthello extension
  111. 14. GnuTLS
  112. 14.2 check connection
  113. 15. Schannel
  114. 15.1 Extend support for client certificate authentication
  115. 15.2 Extend support for the --ciphers option
  116. 15.4 Add option to allow abrupt server closure
  117. 16. SASL
  118. 16.1 Other authentication mechanisms
  119. 16.2 Add QOP support to GSSAPI authentication
  120. 17. SSH protocols
  121. 17.1 Multiplexing
  122. 17.2 Handle growing SFTP files
  123. 17.3 Read keys from ~/.ssh/id_ecdsa, id_ed25519
  124. 17.4 Support CURLOPT_PREQUOTE
  125. 17.5 SSH over HTTPS proxy with more backends
  126. 17.6 SFTP with SCP://
  127. 18. Command line tool
  128. 18.1 sync
  129. 18.2 glob posts
  130. 18.4 --proxycommand
  131. 18.5 UTF-8 filenames in Content-Disposition
  132. 18.6 Option to make -Z merge lined based outputs on stdout
  133. 18.8 Consider convenience options for JSON and XML?
  134. 18.9 Choose the name of file in braces for complex URLs
  135. 18.10 improve how curl works in a windows console window
  136. 18.11 Windows: set attribute 'archive' for completed downloads
  137. 18.12 keep running, read instructions from pipe/socket
  138. 18.13 Ratelimit or wait between serial requests
  139. 18.14 --dry-run
  140. 18.15 --retry should resume
  141. 18.16 send only part of --data
  142. 18.17 consider file name from the redirected URL with -O ?
  143. 18.18 retry on network is unreachable
  144. 18.19 expand ~/ in config files
  145. 18.20 host name sections in config files
  146. 18.21 retry on the redirected-to URL
  147. 18.23 Set the modification date on an uploaded file
  148. 18.24 Use multiple parallel transfers for a single download
  149. 18.25 Prevent terminal injection when writing to terminal
  150. 18.26 Custom progress meter update interval
  151. 18.27 -J and -O with %-encoded file names
  152. 18.28 -J with -C -
  153. 18.29 --retry and transfer timeouts
  154. 19. Build
  155. 19.1 roffit
  156. 19.2 Enable PIE and RELRO by default
  157. 19.3 Do not use GNU libtool on OpenBSD
  158. 19.4 Package curl for Windows in a signed installer
  159. 19.5 make configure use --cache-file more and better
  160. 19.6 build curl with Windows Unicode support
  161. 20. Test suite
  162. 20.1 SSL tunnel
  163. 20.2 nicer lacking perl message
  164. 20.3 more protocols supported
  165. 20.4 more platforms supported
  166. 20.5 Add support for concurrent connections
  167. 20.6 Use the RFC 6265 test suite
  168. 20.7 Support LD_PRELOAD on macOS
  169. 20.8 Run web-platform-tests URL tests
  170. 21. MQTT
  171. 21.1 Support rate-limiting
  172. ==============================================================================
  173. 1. libcurl
  174. 1.1 TFO support on Windows
  175. libcurl supports the CURLOPT_TCP_FASTOPEN option since 7.49.0 for Linux and
  176. Mac OS. Windows supports TCP Fast Open starting with Windows 10, version 1607
  177. and we should add support for it.
  178. TCP Fast Open is supported on several platforms but not on Windows. Work on
  179. this was once started but never finished.
  180. See https://github.com/curl/curl/pull/3378
  181. 1.2 Consult %APPDATA% also for .netrc
  182. %APPDATA%\.netrc is not considered when running on Windows. should not it?
  183. See https://github.com/curl/curl/issues/4016
  184. 1.3 struct lifreq
  185. Use 'struct lifreq' and SIOCGLIFADDR instead of 'struct ifreq' and
  186. SIOCGIFADDR on newer Solaris versions as they claim the latter is obsolete.
  187. To support IPv6 interface addresses for network interfaces properly.
  188. 1.4 Better and more sharing
  189. The share interface could benefit from allowing the alt-svc cache to be
  190. possible to share between easy handles.
  191. See https://github.com/curl/curl/issues/4476
  192. The share interface offers CURL_LOCK_DATA_CONNECT to have multiple easy
  193. handle share a connection cache, but due to how connections are used they are
  194. still not thread-safe when used shared.
  195. See https://github.com/curl/curl/issues/4915 and lib1541.c
  196. The share interface offers CURL_LOCK_DATA_HSTS to have multiple easy handle
  197. share a HSTS cache, but this is not thread-safe.
  198. 1.5 get rid of PATH_MAX
  199. Having code use and rely on PATH_MAX is not nice:
  200. https://insanecoding.blogspot.com/2007/11/pathmax-simply-isnt.html
  201. Currently the libssh2 SSH based code uses it, but to remove PATH_MAX from
  202. there we need libssh2 to properly tell us when we pass in a too small buffer
  203. and its current API (as of libssh2 1.2.7) does not.
  204. 1.6 native IDN support on macOS
  205. On recent macOS versions, the getaddrinfo() function itself has built-in IDN
  206. support. By setting the AI_CANONNAME flag, the function will return the
  207. encoded name in the ai_canonname struct field in the returned information.
  208. This could be used by curl on macOS when built without a separate IDN library
  209. and an IDN host name is used in a URL.
  210. See initial work in https://github.com/curl/curl/pull/5371
  211. 1.8 CURLOPT_RESOLVE for any port number
  212. This option allows applications to set a replacement IP address for a given
  213. host + port pair. Consider making support for providing a replacement address
  214. for the host name on all port numbers.
  215. See https://github.com/curl/curl/issues/1264
  216. 1.9 Cache negative name resolves
  217. A name resolve that has failed is likely to fail when made again within a
  218. short period of time. Currently we only cache positive responses.
  219. 1.10 auto-detect proxy
  220. libcurl could be made to detect the system proxy setup automatically and use
  221. that. On Windows, macOS and Linux desktops for example.
  222. The pull-request to use libproxy for this was deferred due to doubts on the
  223. reliability of the dependency and how to use it:
  224. https://github.com/curl/curl/pull/977
  225. libdetectproxy is a (C++) library for detecting the proxy on Windows
  226. https://github.com/paulharris/libdetectproxy
  227. 1.11 minimize dependencies with dynamically loaded modules
  228. We can create a system with loadable modules/plug-ins, where these modules
  229. would be the ones that link to 3rd party libs. That would allow us to avoid
  230. having to load ALL dependencies since only the necessary ones for this
  231. app/invoke/used protocols would be necessary to load. See
  232. https://github.com/curl/curl/issues/349
  233. 1.12 updated DNS server while running
  234. If /etc/resolv.conf gets updated while a program using libcurl is running, it
  235. is may cause name resolves to fail unless res_init() is called. We should
  236. consider calling res_init() + retry once unconditionally on all name resolve
  237. failures to mitigate against this. Firefox works like that. Note that Windows
  238. does not have res_init() or an alternative.
  239. https://github.com/curl/curl/issues/2251
  240. 1.13 c-ares and CURLOPT_OPENSOCKETFUNCTION
  241. curl will create most sockets via the CURLOPT_OPENSOCKETFUNCTION callback and
  242. close them with the CURLOPT_CLOSESOCKETFUNCTION callback. However, c-ares
  243. does not use those functions and instead opens and closes the sockets
  244. itself. This means that when curl passes the c-ares socket to the
  245. CURLMOPT_SOCKETFUNCTION it is not owned by the application like other sockets.
  246. See https://github.com/curl/curl/issues/2734
  247. 1.15 Monitor connections in the connection pool
  248. libcurl's connection cache or pool holds a number of open connections for the
  249. purpose of possible subsequent connection reuse. It may contain a few up to a
  250. significant amount of connections. Currently, libcurl leaves all connections
  251. as they are and first when a connection is iterated over for matching or
  252. reuse purpose it is verified that it is still alive.
  253. Those connections may get closed by the server side for idleness or they may
  254. get an HTTP/2 ping from the peer to verify that they are still alive. By
  255. adding monitoring of the connections while in the pool, libcurl can detect
  256. dead connections (and close them) better and earlier, and it can handle
  257. HTTP/2 pings to keep such ones alive even when not actively doing transfers
  258. on them.
  259. 1.16 Try to URL encode given URL
  260. Given a URL that for example contains spaces, libcurl could have an option
  261. that would try somewhat harder than it does now and convert spaces to %20 and
  262. perhaps URL encoded byte values over 128 etc (basically do what the redirect
  263. following code already does).
  264. https://github.com/curl/curl/issues/514
  265. 1.17 Add support for IRIs
  266. IRIs (RFC 3987) allow localized, non-ascii, names in the URL. To properly
  267. support this, curl/libcurl would need to translate/encode the given input
  268. from the input string encoding into percent encoded output "over the wire".
  269. To make that work smoothly for curl users even on Windows, curl would
  270. probably need to be able to convert from several input encodings.
  271. 1.18 try next proxy if one does not work
  272. Allow an application to specify a list of proxies to try, and failing to
  273. connect to the first go on and try the next instead until the list is
  274. exhausted. Browsers support this feature at least when they specify proxies
  275. using PACs.
  276. https://github.com/curl/curl/issues/896
  277. 1.19 provide timing info for each redirect
  278. curl and libcurl provide timing information via a set of different
  279. time-stamps (CURLINFO_*_TIME). When curl is following redirects, those
  280. returned time value are the accumulated sums. An improvement could be to
  281. offer separate timings for each redirect.
  282. https://github.com/curl/curl/issues/6743
  283. 1.20 SRV and URI DNS records
  284. Offer support for resolving SRV and URI DNS records for libcurl to know which
  285. server to connect to for various protocols (including HTTP).
  286. 1.21 netrc caching and sharing
  287. The netrc file is read and parsed each time a connection is setup, which
  288. means that if a transfer needs multiple connections for authentication or
  289. redirects, the file might be reread (and parsed) multiple times. This makes
  290. it impossible to provide the file as a pipe.
  291. 1.22 CURLINFO_PAUSE_STATE
  292. Return information about the transfer's current pause state, in both
  293. directions. https://github.com/curl/curl/issues/2588
  294. 1.23 Offer API to flush the connection pool
  295. Sometimes applications want to flush all the existing connections kept alive.
  296. An API could allow a forced flush or just a forced loop that would properly
  297. close all connections that have been closed by the server already.
  298. 1.25 Expose tried IP addresses that failed
  299. When libcurl fails to connect to a host, it could offer the application the
  300. addresses that were used in the attempt. Source + dest IP, source + dest port
  301. and protocol (UDP or TCP) for each failure. Possibly as a callback. Perhaps
  302. also provide "reason".
  303. https://github.com/curl/curl/issues/2126
  304. 1.28 FD_CLOEXEC
  305. It sets the close-on-exec flag for the file descriptor, which causes the file
  306. descriptor to be automatically (and atomically) closed when any of the
  307. exec-family functions succeed. Should probably be set by default?
  308. https://github.com/curl/curl/issues/2252
  309. 1.29 WebSocket read callback
  310. Call the read callback once the connection is established to allow sending
  311. the first message in the connection.
  312. https://github.com/curl/curl/issues/11402
  313. 1.30 config file parsing
  314. Consider providing an API, possibly in a separate companion library, for
  315. parsing a config file like curl's -K/--config option to allow applications to
  316. get the same ability to read curl options from files.
  317. See https://github.com/curl/curl/issues/3698
  318. 1.31 erase secrets from heap/stack after use
  319. Introducing a concept and system to erase secrets from memory after use, it
  320. could help mitigate and lessen the impact of (future) security problems etc.
  321. However: most secrets are passed to libcurl as clear text from the
  322. application and then clearing them within the library adds nothing...
  323. https://github.com/curl/curl/issues/7268
  324. 1.32 add asynch getaddrinfo support
  325. Use getaddrinfo_a() to provide an asynch name resolver backend to libcurl
  326. that does not use threads and does not depend on c-ares. The getaddrinfo_a
  327. function is (probably?) glibc specific but that is a widely used libc among
  328. our users.
  329. https://github.com/curl/curl/pull/6746
  330. 1.33 make DoH inherit more transfer properties
  331. Some options are not inherited because they are not relevant for the DoH SSL
  332. connections, or inheriting the option may result in unexpected behavior. For
  333. example the user's debug function callback is not inherited because it would
  334. be unexpected for internal handles (ie DoH handles) to be passed to that
  335. callback.
  336. If an option is not inherited then it is not possible to set it separately
  337. for DoH without a DoH-specific option. For example:
  338. CURLOPT_DOH_SSL_VERIFYHOST, CURLOPT_DOH_SSL_VERIFYPEER and
  339. CURLOPT_DOH_SSL_VERIFYSTATUS.
  340. See https://github.com/curl/curl/issues/6605
  341. 2. libcurl - multi interface
  342. 2.1 More non-blocking
  343. Make sure we do not ever loop because of non-blocking sockets returning
  344. EWOULDBLOCK or similar. Blocking cases include:
  345. - Name resolves on non-windows unless c-ares or the threaded resolver is used.
  346. - The threaded resolver may block on cleanup:
  347. https://github.com/curl/curl/issues/4852
  348. - file:// transfers
  349. - TELNET transfers
  350. - GSSAPI authentication for FTP transfers
  351. - The "DONE" operation (post transfer protocol-specific actions) for the
  352. protocols SFTP, SMTP, FTP. Fixing multi_done() for this is a worthy task.
  353. - curl_multi_remove_handle for any of the above. See section 2.3.
  354. 2.2 Better support for same name resolves
  355. If a name resolve has been initiated for name NN and a second easy handle
  356. wants to resolve that name as well, make it wait for the first resolve to end
  357. up in the cache instead of doing a second separate resolve. This is
  358. especially needed when adding many simultaneous handles using the same host
  359. name when the DNS resolver can get flooded.
  360. 2.3 Non-blocking curl_multi_remove_handle()
  361. The multi interface has a few API calls that assume a blocking behavior, like
  362. add_handle() and remove_handle() which limits what we can do internally. The
  363. multi API need to be moved even more into a single function that "drives"
  364. everything in a non-blocking manner and signals when something is done. A
  365. remove or add would then only ask for the action to get started and then
  366. multi_perform() etc still be called until the add/remove is completed.
  367. 2.4 Split connect and authentication process
  368. The multi interface treats the authentication process as part of the connect
  369. phase. As such any failures during authentication will not trigger the relevant
  370. QUIT or LOGOFF for protocols such as IMAP, POP3 and SMTP.
  371. 2.5 Edge-triggered sockets should work
  372. The multi_socket API should work with edge-triggered socket events. One of
  373. the internal actions that need to be improved for this to work perfectly is
  374. the 'maxloops' handling in transfer.c:readwrite_data().
  375. 2.6 multi upkeep
  376. In libcurl 7.62.0 we introduced curl_easy_upkeep. It unfortunately only works
  377. on easy handles. We should introduces a version of that for the multi handle,
  378. and also consider doing "upkeep" automatically on connections in the
  379. connection pool when the multi handle is in used.
  380. See https://github.com/curl/curl/issues/3199
  381. 2.7 Virtual external sockets
  382. libcurl performs operations on the given file descriptor that presumes it is
  383. a socket and an application cannot replace them at the moment. Allowing an
  384. application to fully replace those would allow a larger degree of freedom and
  385. flexibility.
  386. See https://github.com/curl/curl/issues/5835
  387. 2.8 dynamically decide to use socketpair
  388. For users who do not use curl_multi_wait() or do not care for
  389. curl_multi_wakeup(), we could introduce a way to make libcurl NOT
  390. create a socketpair in the multi handle.
  391. See https://github.com/curl/curl/issues/4829
  392. 3. Documentation
  393. 3.1 Improve documentation about fork safety
  394. See https://github.com/curl/curl/issues/6968
  395. 3.2 Provide cmake config-file
  396. A config-file package is a set of files provided by us to allow applications
  397. to write cmake scripts to find and use libcurl easier. See
  398. https://github.com/curl/curl/issues/885
  399. 4. FTP
  400. 4.1 HOST
  401. HOST is a command for a client to tell which host name to use, to offer FTP
  402. servers named-based virtual hosting:
  403. https://datatracker.ietf.org/doc/html/rfc7151
  404. 4.2 Alter passive/active on failure and retry
  405. When trying to connect passively to a server which only supports active
  406. connections, libcurl returns CURLE_FTP_WEIRD_PASV_REPLY and closes the
  407. connection. There could be a way to fallback to an active connection (and
  408. vice versa). https://curl.se/bug/feature.cgi?id=1754793
  409. 4.3 Earlier bad letter detection
  410. Make the detection of (bad) %0d and %0a codes in FTP URL parts earlier in the
  411. process to avoid doing a resolve and connect in vain.
  412. 4.4 Support CURLOPT_PREQUOTE for dir listings too
  413. The lack of support is mostly an oversight and requires the FTP state machine
  414. to get updated to get fixed.
  415. https://github.com/curl/curl/issues/8602
  416. 4.5 ASCII support
  417. FTP ASCII transfers do not follow RFC 959. They do not convert the data
  418. accordingly.
  419. 4.6 GSSAPI via Windows SSPI
  420. In addition to currently supporting the SASL GSSAPI mechanism (Kerberos V5)
  421. via third-party GSS-API libraries, such as Heimdal or MIT Kerberos, also add
  422. support for GSSAPI authentication via Windows SSPI.
  423. 4.7 STAT for LIST without data connection
  424. Some FTP servers allow STAT for listing directories instead of using LIST,
  425. and the response is then sent over the control connection instead of as the
  426. otherwise usedw data connection: https://www.nsftools.com/tips/RawFTP.htm#STAT
  427. This is not detailed in any FTP specification.
  428. 4.8 Passive transfer could try other IP addresses
  429. When doing FTP operations through a proxy at localhost, the reported spotted
  430. that curl only tried to connect once to the proxy, while it had multiple
  431. addresses and a failed connect on one address should make it try the next.
  432. After switching to passive mode (EPSV), curl could try all IP addresses for
  433. "localhost". Currently it tries ::1, but it should also try 127.0.0.1.
  434. See https://github.com/curl/curl/issues/1508
  435. 5. HTTP
  436. 5.1 Provide the error body from a CONNECT response
  437. When curl receives a body response from a CONNECT request to a proxy, it will
  438. always just read and ignore it. It would make some users happy if curl
  439. instead optionally would be able to make that responsible available. Via a new
  440. callback? Through some other means?
  441. See https://github.com/curl/curl/issues/9513
  442. 5.2 Obey Retry-After in redirects
  443. The Retry-After is said to dicate "the minimum time that the user agent is
  444. asked to wait before issuing the redirected request" and libcurl does not
  445. obey this.
  446. See https://github.com/curl/curl/issues/11447
  447. 5.3 Rearrange request header order
  448. Server implementors often make an effort to detect browser and to reject
  449. clients it can detect to not match. One of the last details we cannot yet
  450. control in libcurl's HTTP requests, which also can be exploited to detect
  451. that libcurl is in fact used even when it tries to impersonate a browser, is
  452. the order of the request headers. I propose that we introduce a new option in
  453. which you give headers a value, and then when the HTTP request is built it
  454. sorts the headers based on that number. We could then have internally created
  455. headers use a default value so only headers that need to be moved have to be
  456. specified.
  457. 5.4 Allow SAN names in HTTP/2 server push
  458. curl only allows HTTP/2 push promise if the provided :authority header value
  459. exactly matches the host name given in the URL. It could be extended to allow
  460. any name that would match the Subject Alternative Names in the server's TLS
  461. certificate.
  462. See https://github.com/curl/curl/pull/3581
  463. 5.5 auth= in URLs
  464. Add the ability to specify the preferred authentication mechanism to use by
  465. using ;auth=<mech> in the login part of the URL.
  466. For example:
  467. http://test:pass;auth=NTLM@example.com would be equivalent to specifying
  468. --user test:pass;auth=NTLM or --user test:pass --ntlm from the command line.
  469. Additionally this should be implemented for proxy base URLs as well.
  470. 5.6 alt-svc should fallback if alt-svc does not work
  471. The alt-svc: header provides a set of alternative services for curl to use
  472. instead of the original. If the first attempted one fails, it should try the
  473. next etc and if all alternatives fail go back to the original.
  474. See https://github.com/curl/curl/issues/4908
  475. 5.7 Require HTTP version X or higher
  476. curl and libcurl provide options for trying higher HTTP versions (for example
  477. HTTP/2) but then still allows the server to pick version 1.1. We could
  478. consider adding a way to require a minimum version.
  479. See https://github.com/curl/curl/issues/7980
  480. 6. TELNET
  481. 6.1 ditch stdin
  482. Reading input (to send to the remote server) on stdin is a crappy solution
  483. for library purposes. We need to invent a good way for the application to be
  484. able to provide the data to send.
  485. 6.2 ditch telnet-specific select
  486. Move the telnet support's network select() loop go away and merge the code
  487. into the main transfer loop. Until this is done, the multi interface will not
  488. work for telnet.
  489. 6.3 feature negotiation debug data
  490. Add telnet feature negotiation data to the debug callback as header data.
  491. 6.4 exit immediately upon connection if stdin is /dev/null
  492. If it did, curl could be used to probe if there's an server there listening
  493. on a specific port. That is, the following command would exit immediately
  494. after the connection is established with exit code 0:
  495. curl -s --connect-timeout 2 telnet://example.com:80 </dev/null
  496. 7. SMTP
  497. 7.1 Passing NOTIFY option to CURLOPT_MAIL_RCPT
  498. Is there a way to pass the NOTIFY option to the CURLOPT_MAIL_RCPT option ? I
  499. set a string that already contains a bracket. For instance something like
  500. that: curl_slist_append( recipients, "<foo@bar> NOTIFY=SUCCESS,FAILURE" );
  501. https://github.com/curl/curl/issues/8232
  502. 7.2 Enhanced capability support
  503. Add the ability, for an application that uses libcurl, to obtain the list of
  504. capabilities returned from the EHLO command.
  505. 7.3 Add CURLOPT_MAIL_CLIENT option
  506. Rather than use the URL to specify the mail client string to present in the
  507. HELO and EHLO commands, libcurl should support a new CURLOPT specifically for
  508. specifying this data as the URL is non-standard and to be honest a bit of a
  509. hack ;-)
  510. Please see the following thread for more information:
  511. https://curl.se/mail/lib-2012-05/0178.html
  512. 8. POP3
  513. 8.2 Enhanced capability support
  514. Add the ability, for an application that uses libcurl, to obtain the list of
  515. capabilities returned from the CAPA command.
  516. 9. IMAP
  517. 9.1 Enhanced capability support
  518. Add the ability, for an application that uses libcurl, to obtain the list of
  519. capabilities returned from the CAPABILITY command.
  520. 10. LDAP
  521. 10.1 SASL based authentication mechanisms
  522. Currently the LDAP module only supports ldap_simple_bind_s() in order to bind
  523. to an LDAP server. However, this function sends username and password details
  524. using the simple authentication mechanism (as clear text). However, it should
  525. be possible to use ldap_bind_s() instead specifying the security context
  526. information ourselves.
  527. 10.2 CURLOPT_SSL_CTX_FUNCTION for LDAPS
  528. CURLOPT_SSL_CTX_FUNCTION works perfectly for HTTPS and email protocols, but
  529. it has no effect for LDAPS connections.
  530. https://github.com/curl/curl/issues/4108
  531. 10.3 Paged searches on LDAP server
  532. https://github.com/curl/curl/issues/4452
  533. 10.4 Certificate-Based Authentication
  534. LDAPS not possible with MAC and Windows with Certificate-Based Authentication
  535. https://github.com/curl/curl/issues/9641
  536. 11. SMB
  537. 11.1 File listing support
  538. Add support for listing the contents of a SMB share. The output should
  539. probably be the same as/similar to FTP.
  540. 11.2 Honor file timestamps
  541. The timestamp of the transferred file should reflect that of the original
  542. file.
  543. 11.3 Use NTLMv2
  544. Currently the SMB authentication uses NTLMv1.
  545. 11.4 Create remote directories
  546. Support for creating remote directories when uploading a file to a directory
  547. that does not exist on the server, just like --ftp-create-dirs.
  548. 12. FILE
  549. 12.1 Directory listing for FILE:
  550. Add support for listing the contents of a directory accessed with FILE. The
  551. output should probably be the same as/similar to FTP.
  552. 13. TLS
  553. 13.1 TLS-PSK with OpenSSL
  554. Transport Layer Security pre-shared key ciphersuites (TLS-PSK) is a set of
  555. cryptographic protocols that provide secure communication based on pre-shared
  556. keys (PSKs). These pre-shared keys are symmetric keys shared in advance among
  557. the communicating parties.
  558. https://github.com/curl/curl/issues/5081
  559. 13.2 Provide mutex locking API
  560. Provide a libcurl API for setting mutex callbacks in the underlying SSL
  561. library, so that the same application code can use mutex-locking
  562. independently of OpenSSL or GnutTLS being used.
  563. 13.3 Defeat TLS fingerprinting
  564. By changing the order of TLS extensions provided in the TLS handshake, it is
  565. sometimes possible to circumvent TLS fingerprinting by servers. The TLS
  566. extension order is of course not the only way to fingerprint a client.
  567. See https://github.com/curl/curl/issues/8119
  568. 13.4 Cache/share OpenSSL contexts
  569. "Look at SSL cafile - quick traces look to me like these are done on every
  570. request as well, when they should only be necessary once per SSL context (or
  571. once per handle)". The major improvement we can rather easily do is to make
  572. sure we do not create and kill a new SSL "context" for every request, but
  573. instead make one for every connection and re-use that SSL context in the same
  574. style connections are re-used. It will make us use slightly more memory but
  575. it will libcurl do less creations and deletions of SSL contexts.
  576. Technically, the "caching" is probably best implemented by getting added to
  577. the share interface so that easy handles who want to and can reuse the
  578. context specify that by sharing with the right properties set.
  579. https://github.com/curl/curl/issues/1110
  580. 13.5 Export session ids
  581. Add an interface to libcurl that enables "session IDs" to get
  582. exported/imported. Cris Bailiff said: "OpenSSL has functions which can
  583. serialise the current SSL state to a buffer of your choice, and recover/reset
  584. the state from such a buffer at a later date - this is used by mod_ssl for
  585. apache to implement and SSL session ID cache".
  586. 13.6 Provide callback for cert verification
  587. OpenSSL supports a callback for customised verification of the peer
  588. certificate, but this does not seem to be exposed in the libcurl APIs. Could
  589. it be? There's so much that could be done if it were.
  590. 13.7 Less memory massaging with Schannel
  591. The Schannel backend does a lot of custom memory management we would rather
  592. avoid: the repeated alloc + free in sends and the custom memory + realloc
  593. system for encrypted and decrypted data. That should be avoided and reduced
  594. for 1) efficiency and 2) safety.
  595. 13.8 Support DANE
  596. DNS-Based Authentication of Named Entities (DANE) is a way to provide SSL
  597. keys and certs over DNS using DNSSEC as an alternative to the CA model.
  598. https://www.rfc-editor.org/rfc/rfc6698.txt
  599. An initial patch was posted by Suresh Krishnaswamy on March 7th 2013
  600. (https://curl.se/mail/lib-2013-03/0075.html) but it was a too simple
  601. approach. See Daniel's comments:
  602. https://curl.se/mail/lib-2013-03/0103.html . libunbound may be the
  603. correct library to base this development on.
  604. Björn Stenberg wrote a separate initial take on DANE that was never
  605. completed.
  606. 13.9 TLS record padding
  607. TLS (1.3) offers optional record padding and OpenSSL provides an API for it.
  608. I could make sense for libcurl to offer this ability to applications to make
  609. traffic patterns harder to figure out by network traffic observers.
  610. See https://github.com/curl/curl/issues/5398
  611. 13.10 Support Authority Information Access certificate extension (AIA)
  612. AIA can provide various things like CRLs but more importantly information
  613. about intermediate CA certificates that can allow validation path to be
  614. fulfilled when the HTTPS server does not itself provide them.
  615. Since AIA is about downloading certs on demand to complete a TLS handshake,
  616. it is probably a bit tricky to get done right.
  617. See https://github.com/curl/curl/issues/2793
  618. 13.12 Reduce CA certificate bundle reparsing
  619. When using the OpenSSL backend, curl will load and reparse the CA bundle at
  620. the creation of the "SSL context" when it sets up a connection to do a TLS
  621. handshake. A more effective way would be to somehow cache the CA bundle to
  622. avoid it having to be repeatedly reloaded and reparsed.
  623. See https://github.com/curl/curl/issues/9379
  624. 13.13 Make sure we forbid TLS 1.3 post-handshake authentication
  625. RFC 8740 explains how using HTTP/2 must forbid the use of TLS 1.3
  626. post-handshake authentication. We should make sure to live up to that.
  627. See https://github.com/curl/curl/issues/5396
  628. 13.14 Support the clienthello extension
  629. Certain stupid networks and middle boxes have a problem with SSL handshake
  630. packets that are within a certain size range because how that sets some bits
  631. that previously (in older TLS version) were not set. The clienthello
  632. extension adds padding to avoid that size range.
  633. https://datatracker.ietf.org/doc/html/rfc7685
  634. https://github.com/curl/curl/issues/2299
  635. 14. GnuTLS
  636. 14.2 check connection
  637. Add a way to check if the connection seems to be alive, to correspond to the
  638. SSL_peak() way we use with OpenSSL.
  639. 15. Schannel
  640. 15.1 Extend support for client certificate authentication
  641. The existing support for the -E/--cert and --key options could be
  642. extended by supplying a custom certificate and key in PEM format, see:
  643. - Getting a Certificate for Schannel
  644. https://msdn.microsoft.com/en-us/library/windows/desktop/aa375447.aspx
  645. 15.2 Extend support for the --ciphers option
  646. The existing support for the --ciphers option could be extended
  647. by mapping the OpenSSL/GnuTLS cipher suites to the Schannel APIs, see
  648. - Specifying Schannel Ciphers and Cipher Strengths
  649. https://msdn.microsoft.com/en-us/library/windows/desktop/aa380161.aspx
  650. 15.4 Add option to allow abrupt server closure
  651. libcurl w/schannel will error without a known termination point from the
  652. server (such as length of transfer, or SSL "close notify" alert) to prevent
  653. against a truncation attack. Really old servers may neglect to send any
  654. termination point. An option could be added to ignore such abrupt closures.
  655. https://github.com/curl/curl/issues/4427
  656. 16. SASL
  657. 16.1 Other authentication mechanisms
  658. Add support for other authentication mechanisms such as OLP,
  659. GSS-SPNEGO and others.
  660. 16.2 Add QOP support to GSSAPI authentication
  661. Currently the GSSAPI authentication only supports the default QOP of auth
  662. (Authentication), whilst Kerberos V5 supports both auth-int (Authentication
  663. with integrity protection) and auth-conf (Authentication with integrity and
  664. privacy protection).
  665. 17. SSH protocols
  666. 17.1 Multiplexing
  667. SSH is a perfectly fine multiplexed protocols which would allow libcurl to do
  668. multiple parallel transfers from the same host using the same connection,
  669. much in the same spirit as HTTP/2 does. libcurl however does not take
  670. advantage of that ability but will instead always create a new connection for
  671. new transfers even if an existing connection already exists to the host.
  672. To fix this, libcurl would have to detect an existing connection and "attach"
  673. the new transfer to the existing one.
  674. 17.2 Handle growing SFTP files
  675. The SFTP code in libcurl checks the file size *before* a transfer starts and
  676. then proceeds to transfer exactly that amount of data. If the remote file
  677. grows while the transfer is in progress libcurl will not notice and will not
  678. adapt. The OpenSSH SFTP command line tool does and libcurl could also just
  679. attempt to download more to see if there is more to get...
  680. https://github.com/curl/curl/issues/4344
  681. 17.3 Read keys from ~/.ssh/id_ecdsa, id_ed25519
  682. The libssh2 backend in curl is limited to only reading keys from id_rsa and
  683. id_dsa, which makes it fail connecting to servers that use more modern key
  684. types.
  685. https://github.com/curl/curl/issues/8586
  686. 17.4 Support CURLOPT_PREQUOTE
  687. The two other QUOTE options are supported for SFTP, but this was left out for
  688. unknown reasons.
  689. 17.5 SSH over HTTPS proxy with more backends
  690. The SSH based protocols SFTP and SCP did not work over HTTPS proxy at
  691. all until PR https://github.com/curl/curl/pull/6021 brought the
  692. functionality with the libssh2 backend. Presumably, this support
  693. can/could be added for the other backends as well.
  694. 17.6 SFTP with SCP://
  695. OpenSSH 9 switched their 'scp' tool to speak SFTP under the hood. Going
  696. forward it might be worth having curl or libcurl attempt SFTP if SCP fails to
  697. follow suite.
  698. 18. Command line tool
  699. 18.1 sync
  700. "curl --sync http://example.com/feed[1-100].rss" or
  701. "curl --sync http://example.net/{index,calendar,history}.html"
  702. Downloads a range or set of URLs using the remote name, but only if the
  703. remote file is newer than the local file. A Last-Modified HTTP date header
  704. should also be used to set the mod date on the downloaded file.
  705. 18.2 glob posts
  706. Globbing support for -d and -F, as in 'curl -d "name=foo[0-9]" URL'.
  707. This is easily scripted though.
  708. 18.4 --proxycommand
  709. Allow the user to make curl run a command and use its stdio to make requests
  710. and not do any network connection by itself. Example:
  711. curl --proxycommand 'ssh pi@raspberrypi.local -W 10.1.1.75 80' \
  712. http://some/otherwise/unavailable/service.php
  713. See https://github.com/curl/curl/issues/4941
  714. 18.5 UTF-8 filenames in Content-Disposition
  715. RFC 6266 documents how UTF-8 names can be passed to a client in the
  716. Content-Disposition header, and curl does not support this.
  717. https://github.com/curl/curl/issues/1888
  718. 18.6 Option to make -Z merge lined based outputs on stdout
  719. When a user requests multiple lined based files using -Z and sends them to
  720. stdout, curl will not "merge" and send complete lines fine but may send
  721. partial lines from several sources.
  722. https://github.com/curl/curl/issues/5175
  723. 18.8 Consider convenience options for JSON and XML?
  724. Could we add `--xml` or `--json` to add headers needed to call rest API:
  725. `--xml` adds -H 'Content-Type: application/xml' -H "Accept: application/xml" and
  726. `--json` adds -H 'Content-Type: application/json' -H "Accept: application/json"
  727. Setting Content-Type when doing a GET or any other method without a body
  728. would be a bit strange I think - so maybe only add CT for requests with body?
  729. Maybe plain `--xml` and ` --json` are a bit too brief and generic. Maybe
  730. `--http-json` etc?
  731. See https://github.com/curl/curl/issues/5203
  732. 18.9 Choose the name of file in braces for complex URLs
  733. When using braces to download a list of URLs and you use complicated names
  734. in the list of alternatives, it could be handy to allow curl to use other
  735. names when saving.
  736. Consider a way to offer that. Possibly like
  737. {partURL1:name1,partURL2:name2,partURL3:name3} where the name following the
  738. colon is the output name.
  739. See https://github.com/curl/curl/issues/221
  740. 18.10 improve how curl works in a windows console window
  741. If you pull the scrollbar when transferring with curl in a Windows console
  742. window, the transfer is interrupted and can get disconnected. This can
  743. probably be improved. See https://github.com/curl/curl/issues/322
  744. 18.11 Windows: set attribute 'archive' for completed downloads
  745. The archive bit (FILE_ATTRIBUTE_ARCHIVE, 0x20) separates files that shall be
  746. backed up from those that are either not ready or have not changed.
  747. Downloads in progress are neither ready to be backed up, nor should they be
  748. opened by a different process. Only after a download has been completed it's
  749. sensible to include it in any integer snapshot or backup of the system.
  750. See https://github.com/curl/curl/issues/3354
  751. 18.12 keep running, read instructions from pipe/socket
  752. Provide an option that makes curl not exit after the last URL (or even work
  753. without a given URL), and then make it read instructions passed on a pipe or
  754. over a socket to make further instructions so that a second subsequent curl
  755. invoke can talk to the still running instance and ask for transfers to get
  756. done, and thus maintain its connection pool, DNS cache and more.
  757. 18.13 Ratelimit or wait between serial requests
  758. Consider a command line option that can make curl do multiple serial requests
  759. slow, potentially with a (random) wait between transfers. There's also a
  760. proposed set of standard HTTP headers to let servers let the client adapt to
  761. its rate limits:
  762. https://www.ietf.org/id/draft-polli-ratelimit-headers-02.html
  763. See https://github.com/curl/curl/issues/5406
  764. 18.14 --dry-run
  765. A command line option that makes curl show exactly what it would do and send
  766. if it would run for real.
  767. See https://github.com/curl/curl/issues/5426
  768. 18.15 --retry should resume
  769. When --retry is used and curl actually retries transfer, it should use the
  770. already transferred data and do a resumed transfer for the rest (when
  771. possible) so that it does not have to transfer the same data again that was
  772. already transferred before the retry.
  773. See https://github.com/curl/curl/issues/1084
  774. 18.16 send only part of --data
  775. When the user only wants to send a small piece of the data provided with
  776. --data or --data-binary, like when that data is a huge file, consider a way
  777. to specify that curl should only send a piece of that. One suggested syntax
  778. would be: "--data-binary @largefile.zip!1073741823-2147483647".
  779. See https://github.com/curl/curl/issues/1200
  780. 18.17 consider file name from the redirected URL with -O ?
  781. When a user gives a URL and uses -O, and curl follows a redirect to a new
  782. URL, the file name is not extracted and used from the newly redirected-to URL
  783. even if the new URL may have a much more sensible file name.
  784. This is clearly documented and helps for security since there's no surprise
  785. to users which file name that might get overwritten. But maybe a new option
  786. could allow for this or maybe -J should imply such a treatment as well as -J
  787. already allows for the server to decide what file name to use so it already
  788. provides the "may overwrite any file" risk.
  789. This is extra tricky if the original URL has no file name part at all since
  790. then the current code path will error out with an error message, and we cannot
  791. *know* already at that point if curl will be redirected to a URL that has a
  792. file name...
  793. See https://github.com/curl/curl/issues/1241
  794. 18.18 retry on network is unreachable
  795. The --retry option retries transfers on "transient failures". We later added
  796. --retry-connrefused to also retry for "connection refused" errors.
  797. Suggestions have been brought to also allow retry on "network is unreachable"
  798. errors and while totally reasonable, maybe we should consider a way to make
  799. this more configurable than to add a new option for every new error people
  800. want to retry for?
  801. https://github.com/curl/curl/issues/1603
  802. 18.19 expand ~/ in config files
  803. For example .curlrc could benefit from being able to do this.
  804. See https://github.com/curl/curl/issues/2317
  805. 18.20 host name sections in config files
  806. config files would be more powerful if they could set different
  807. configurations depending on used URLs, host name or possibly origin. Then a
  808. default .curlrc could a specific user-agent only when doing requests against
  809. a certain site.
  810. 18.21 retry on the redirected-to URL
  811. When curl is told to --retry a failed transfer and follows redirects, it
  812. might get an HTTP 429 response from the redirected-to URL and not the
  813. original one, which then could make curl decide to rather retry the transfer
  814. on that URL only instead of the original operation to the original URL.
  815. Perhaps extra emphasized if the original transfer is a large POST that
  816. redirects to a separate GET, and that GET is what gets the 529
  817. See https://github.com/curl/curl/issues/5462
  818. 18.23 Set the modification date on an uploaded file
  819. For SFTP and possibly FTP, curl could offer an option to set the
  820. modification time for the uploaded file.
  821. See https://github.com/curl/curl/issues/5768
  822. 18.24 Use multiple parallel transfers for a single download
  823. To enhance transfer speed, downloading a single URL can be split up into
  824. multiple separate range downloads that get combined into a single final
  825. result.
  826. An ideal implementation would not use a specified number of parallel
  827. transfers, but curl could:
  828. - First start getting the full file as transfer A
  829. - If after N seconds have passed and the transfer is expected to continue for
  830. M seconds or more, add a new transfer (B) that asks for the second half of
  831. A's content (and stop A at the middle).
  832. - If splitting up the work improves the transfer rate, it could then be done
  833. again. Then again, etc up to a limit.
  834. This way, if transfer B fails (because Range: is not supported) it will let
  835. transfer A remain the single one. N and M could be set to some sensible
  836. defaults.
  837. See https://github.com/curl/curl/issues/5774
  838. 18.25 Prevent terminal injection when writing to terminal
  839. curl could offer an option to make escape sequence either non-functional or
  840. avoid cursor moves or similar to reduce the risk of a user getting tricked by
  841. clever tricks.
  842. See https://github.com/curl/curl/issues/6150
  843. 18.26 Custom progress meter update interval
  844. Users who are for example doing large downloads in CI or remote setups might
  845. want the occasional progress meter update to see that the transfer is
  846. progressing and has not stuck, but they may not appreciate the
  847. many-times-a-second frequency curl can end up doing it with now.
  848. 18.27 -J and -O with %-encoded file names
  849. -J/--remote-header-name does not decode %-encoded file names. RFC 6266 details
  850. how it should be done. The can of worm is basically that we have no charset
  851. handling in curl and ascii >=128 is a challenge for us. Not to mention that
  852. decoding also means that we need to check for nastiness that is attempted,
  853. like "../" sequences and the like. Probably everything to the left of any
  854. embedded slashes should be cut off.
  855. https://curl.se/bug/view.cgi?id=1294
  856. -O also does not decode %-encoded names, and while it has even less
  857. information about the charset involved the process is similar to the -J case.
  858. Note that we will not add decoding to -O without the user asking for it with
  859. some other means as well, since -O has always been documented to use the name
  860. exactly as specified in the URL.
  861. 18.28 -J with -C -
  862. When using -J (with -O), automatically resumed downloading together with "-C
  863. -" fails. Without -J the same command line works. This happens because the
  864. resume logic is worked out before the target file name (and thus its
  865. pre-transfer size) has been figured out. This can be improved.
  866. https://curl.se/bug/view.cgi?id=1169
  867. 18.29 --retry and transfer timeouts
  868. If using --retry and the transfer timeouts (possibly due to using -m or
  869. -y/-Y) the next attempt does not resume the transfer properly from what was
  870. downloaded in the previous attempt but will truncate and restart at the
  871. original position where it was at before the previous failed attempt. See
  872. https://curl.se/mail/lib-2008-01/0080.html and Mandriva bug report
  873. https://qa.mandriva.com/show_bug.cgi?id=22565
  874. 19. Build
  875. 19.1 roffit
  876. Consider extending 'roffit' to produce decent ASCII output, and use that
  877. instead of (g)nroff when building src/tool_hugehelp.c
  878. 19.2 Enable PIE and RELRO by default
  879. Especially when having programs that execute curl via the command line, PIE
  880. renders the exploitation of memory corruption vulnerabilities a lot more
  881. difficult. This can be attributed to the additional information leaks being
  882. required to conduct a successful attack. RELRO, on the other hand, masks
  883. different binary sections like the GOT as read-only and thus kills a handful
  884. of techniques that come in handy when attackers are able to arbitrarily
  885. overwrite memory. A few tests showed that enabling these features had close
  886. to no impact, neither on the performance nor on the general functionality of
  887. curl.
  888. 19.3 Do not use GNU libtool on OpenBSD
  889. When compiling curl on OpenBSD with "--enable-debug" it will give linking
  890. errors when you use GNU libtool. This can be fixed by using the libtool
  891. provided by OpenBSD itself. However for this the user always needs to invoke
  892. make with "LIBTOOL=/usr/bin/libtool". It would be nice if the script could
  893. have some magic to detect if this system is an OpenBSD host and then use the
  894. OpenBSD libtool instead.
  895. See https://github.com/curl/curl/issues/5862
  896. 19.4 Package curl for Windows in a signed installer
  897. See https://github.com/curl/curl/issues/5424
  898. 19.5 make configure use --cache-file more and better
  899. The configure script can be improved to cache more values so that repeated
  900. invokes run much faster.
  901. See https://github.com/curl/curl/issues/7753
  902. 19.6 build curl with Windows Unicode support
  903. The user wants an easier way to tell autotools to build curl with Windows
  904. Unicode support, like ./configure --enable-windows-unicode
  905. See https://github.com/curl/curl/issues/7229
  906. 20. Test suite
  907. 20.1 SSL tunnel
  908. Make our own version of stunnel for simple port forwarding to enable HTTPS
  909. and FTP-SSL tests without the stunnel dependency, and it could allow us to
  910. provide test tools built with either OpenSSL or GnuTLS
  911. 20.2 nicer lacking perl message
  912. If perl was not found by the configure script, do not attempt to run the tests
  913. but explain something nice why it does not.
  914. 20.3 more protocols supported
  915. Extend the test suite to include more protocols. The telnet could just do FTP
  916. or http operations (for which we have test servers).
  917. 20.4 more platforms supported
  918. Make the test suite work on more platforms. OpenBSD and Mac OS. Remove
  919. fork()s and it should become even more portable.
  920. 20.5 Add support for concurrent connections
  921. Tests 836, 882 and 938 were designed to verify that separate connections
  922. are not used when using different login credentials in protocols that
  923. should not re-use a connection under such circumstances.
  924. Unfortunately, ftpserver.pl does not appear to support multiple concurrent
  925. connections. The read while() loop seems to loop until it receives a
  926. disconnect from the client, where it then enters the waiting for connections
  927. loop. When the client opens a second connection to the server, the first
  928. connection has not been dropped (unless it has been forced - which we
  929. should not do in these tests) and thus the wait for connections loop is never
  930. entered to receive the second connection.
  931. 20.6 Use the RFC 6265 test suite
  932. A test suite made for HTTP cookies (RFC 6265) by Adam Barth is available at
  933. https://github.com/abarth/http-state/tree/master/tests
  934. It'd be really awesome if someone would write a script/setup that would run
  935. curl with that test suite and detect deviances. Ideally, that would even be
  936. incorporated into our regular test suite.
  937. 20.7 Support LD_PRELOAD on macOS
  938. LD_RELOAD does not work on macOS, but there are tests which require it to run
  939. properly. Look into making the preload support in runtests.pl portable such
  940. that it uses DYLD_INSERT_LIBRARIES on macOS.
  941. 20.8 Run web-platform-tests URL tests
  942. Run web-platform-tests URL tests and compare results with browsers on wpt.fyi
  943. It would help us find issues to fix and help us document where our parser
  944. differs from the WHATWG URL spec parsers.
  945. See https://github.com/curl/curl/issues/4477
  946. 21. MQTT
  947. 21.1 Support rate-limiting
  948. The rate-limiting logic is done in the PERFORMING state in multi.c but MQTT
  949. is not (yet) implemented to use that.