                                  _   _ ____  _
                              ___| | | |  _ \| |
                             / __| | | | |_) | |
                            | (__| |_| |  _ <| |___
                             \___|\___/|_| \_\_____|

                                  Changelog

Version 7.65.0 (22 May 2019)

Daniel Stenberg (22 May 2019)
- RELEASE-NOTES: 7.65.0 release

- THANKS: from the 7.65.0 release-notes

- url: convert the zone id from a IPv6 URL to correct scope id
  
  Reported-by: GitYuanQu on github
  Fixes #3902
  Closes #3914

- configure: detect getsockname and getpeername on windows too
  
  Made detection macros for these two functions in the same style as other
  functions possibly in winsock in the hope this will work better to
  detect these functions when cross-compiling for Windows.
  
  Follow-up to e91e4816123
  
  Fixes #3913
  Closes #3915

Marcel Raad (21 May 2019)
- examples: remove unused variables
  
  Fixes Codacy/CppCheck warnings.
  
  Closes

Daniel Gustafsson (21 May 2019)
- udpateconninfo: mark variable unused
  
  When compiling without getpeername() or getsockname(), the sockfd
  paramter to Curl_udpateconninfo() became unused after commit e91e481612
  added ifdef guards.
  
  Closes #3910
  Fixes https://curl.haxx.se/dev/log.cgi?id=20190520172441-32196
  Reviewed-by: Marcel Raad, Daniel Stenberg

- ftp: move ftp_ccc in under featureflag
  
  Commit e91e48161235272ff485ff32bd048c53af731f43 moved ftp_ccc in under
  the FTP featureflag in the UserDefined struct, but vtls callsites were
  still using it unprotected.
  
  Closes #3912
  Fixes: https://curl.haxx.se/dev/log.cgi?id=20190520044705-29865
  Reviewed-by: Daniel Stenberg, Marcel Raad

Daniel Stenberg (20 May 2019)
- curl: report error for "--no-" on non-boolean options
  
  Reported-by: Olen Andoni
  Fixes #3906
  Closes #3907

- [Guy Poizat brought this change]

  mbedtls: enable use of EC keys
  
  Closes #3892

- lib1560: add tests for parsing URL with too long scheme
  
  Ref: #3905

- [Omar Ramadan brought this change]

  urlapi: increase supported scheme length to 40 bytes
  
  The longest currently registered URI scheme at IANA is 36 bytes long.
  
  Closes #3905
  Closes #3900

Marcel Raad (20 May 2019)
- lib: reduce variable scopes
  
  Fixes Codacy/CppCheck warnings.
  
  Closes https://github.com/curl/curl/pull/3872

- tool_formparse: remove redundant assignment
  
  Just initialize word_begin with the correct value.
  
  Closes https://github.com/curl/curl/pull/3873

- ssh: move variable declaration to where it's used
  
  This way, we need only one call to free.
  
  Closes https://github.com/curl/curl/pull/3873

- ssh-libssh: remove unused variable
  
  sock was only used to be assigned to fd_read.
  
  Closes https://github.com/curl/curl/pull/3873

Daniel Stenberg (20 May 2019)
- test332: verify the blksize fix

- tftp: use the current blksize for recvfrom()
  
  bug: https://curl.haxx.se/docs/CVE-2019-5436.html
  Reported-by: l00p3r on hackerone
  CVE-2019-5436

Daniel Gustafsson (19 May 2019)
- version: make ssl_version buffer match for multi_ssl
  
  When running a multi TLS backend build the version string needs more
  buffer space. Make the internal ssl_buffer stack buffer match the one
  in Curl_multissl_version() to allow for the longer string. For single
  TLS backend builds there is no use in extended to buffer. This is a
  fallout from #3863 which fixes up the multi_ssl string generation to
  avoid a buffer overflow when the buffer is too small.
  
  Closes #3875
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Steve Holme (18 May 2019)
- http_ntlm_wb: Handle auth for only a single request
  
  Currently when the server responds with 401 on NTLM authenticated
  connection (re-used) we consider it to have failed.  However this is
  legitimate and may happen when for example IIS is set configured to
  'authPersistSingleRequest' or when the request goes thru a proxy (with
  'via' header).
  
  Implemented by imploying an additional state once a connection is
  re-used to indicate that if we receive 401 we need to restart
  authentication.
  
  Missed in fe6049f0.

- http_ntlm_wb: Cleanup handshake after clean NTLM failure
  
  Missed in 50b87c4e.

- http_ntlm_wb: Return the correct error on receiving an empty auth message
  
  Missed in fe20826b as it wasn't implemented in http.c in b4d6db83.
  
  Closes #3894

Daniel Stenberg (18 May 2019)
- curl: make code work with protocol-disabled libcurl
  
  Closes #3844

- libcurl: #ifdef away more code for disabled features/protocols

- progress: CURL_DISABLE_PROGRESS_METER

- hostip: CURL_DISABLE_SHUFFLE_DNS

- netrc: CURL_DISABLE_NETRC

Viktor Szakats (16 May 2019)
- docs: Markdown and misc improvements [ci skip]
  
  Approved-by: Daniel Stenberg
  Closes #3896

- docs/RELEASE-PROCEDURE: link to live iCalendar [ci skip]
  
  Ref: https://github.com/curl/curl/commit/0af41b40b2c7bd379b2251cbe7cd618e21fa0ea1#commitcomment-33563135
  Approved-by: Daniel Stenberg
  Closes #3895

Daniel Stenberg (16 May 2019)
- travis: add an osx http-only build
  
  Closes #3887

- cleanup: remove FIXME and TODO comments
  
  They serve very little purpose and mostly just add noise. Most of them
  have been around for a very long time. I read them all before removing
  or rephrasing them.
  
  Ref: #3876
  Closes #3883

- curl: don't set FTP options for FTP-disabled builds
  
  ... since libcurl has started to be totally unaware of options for
  disabled protocols they now return error.
  
  Bug: https://github.com/curl/curl/commit/c9c5304dd4747cbe75d2f24be85920d572fcb5b8#commitcomment-33533937
  
  Reported-by: Marcel Raad
  Closes #3886

Steve Holme (16 May 2019)
- http_ntlm_wb: Move the type-2 message processing into a dedicated function
  
  This brings the code inline with the other HTTP authentication mechanisms.
  
  Closes #3890

Daniel Stenberg (15 May 2019)
- RELEASE-NOTES: synced

- docs/RELEASE-PROCEDURE: updated coming releases dates [ci skip]

- CURLOPT_READFUNCTION.3: see also CURLOPT_UPLOAD_BUFFERSIZE [ci skip]
  
  Reported-by: Roy Bellingan
  Bug: #3885

- parse_proxy: use the URL parser API
  
  As we treat a given proxy as a URL we should use the unified URL parser
  to extract the parts out of it.
  
  Closes #3878

Steve Holme (15 May 2019)
- http_negotiate: Move the Negotiate state out of the negotiatedata structure
  
  Given that this member variable is not used by the SASL based protocols
  there is no need to have it here.
  
  Closes #3882

- http_ntlm: Move the NTLM state out of the ntlmdata structure
  
  Given that this member variable is not used by the SASL based protocols
  there is no need to have it here.

- url: Move the negotiate state type into a dedicated enum

- url: Remove duplicate clean up of the winbind variables in conn_shutdown()
  
  Given that Curl_disconnect() calls Curl_http_auth_cleanup_ntlm() prior
  to calling conn_shutdown() and it in turn performs this, there is no
  need to perform the same action in conn_shutdown().
  
  Closes #3881

Daniel Stenberg (14 May 2019)
- urlapi: require a non-zero host name length when parsing URL
  
  Updated test 1560 to verify.
  
  Closes #3880

- configure: error out if OpenSSL wasn't detected when asked for
  
  If --with-ssl is used and configure still couldn't enable SSL this
  creates an error instead of just silently ignoring the fact.
  
  Suggested-by: Isaiah Norton
  Fixes #3824
  Closes #3830

Daniel Gustafsson (14 May 2019)
- imap: Fix typo in comment

Steve Holme (14 May 2019)
- url: Remove unnecessary initialisation from allocate_conn()
  
  No need to set variables to zero as calloc() does this for us.
  
  Closes #3879

Daniel Stenberg (14 May 2019)
- CURLOPT_CAINFO.3: with Schannel, you want Windows 8 or later [ci skip]
  
  Clues-provided-by: Jay Satiro
  Clues-provided-by: Jeroen Ooms
  Fixes #3711
  Closes #3874

Daniel Gustafsson (13 May 2019)
- vtls: fix potential ssl_buffer stack overflow
  
  In Curl_multissl_version() it was possible to overflow the passed in
  buffer if the generated version string exceeded the size of the buffer.
  Fix by inverting the logic, and also make sure to not exceed the local
  buffer during the string generation.
  
  Closes #3863
  Reported-by: nevv on HackerOne/curl
  Reviewed-by: Jay Satiro
  Reviewed-by: Daniel Stenberg

Daniel Stenberg (13 May 2019)
- RELEASE-NOTES: synced

- appveyor: also build "/ci" branches like travis

- pingpong: disable more when no pingpong enabled

- proxy: acknowledge DISABLE_PROXY more

- parsedate: CURL_DISABLE_PARSEDATE

- sasl: only enable if there's a protocol enabled using it

- mime: acknowledge CURL_DISABLE_MIME

- wildcard: disable from build when FTP isn't present

- http: CURL_DISABLE_HTTP_AUTH

- base64: build conditionally if there are users

- doh: CURL_DISABLE_DOH

Steve Holme (12 May 2019)
- auth: Rename the various authentication clean up functions
  
  For consistency and to a avoid confusion.
  
  Closes #3869

Daniel Stenberg (12 May 2019)
- [Jay Satiro brought this change]

  docs/INSTALL: fix broken link [ci skip]
  
  Reported-by: Joombalaya on github
  Fixes #3818

Marcel Raad (12 May 2019)
- easy: fix another "clarify calculation precedence" warning
  
  I missed this one in commit 6b3dde7fe62ea5a557fd1fd323fac2bcd0c2e9be.

- build: fix "clarify calculation precedence" warnings
  
  Codacy/CppCheck warns about this. Consistently use parentheses as we
  already do in some places to silence the warning.
  
  Closes https://github.com/curl/curl/pull/3866

- cmake: restore C89 compatibility of CurlTests.c
  
  I broke it in d1b5cf830bfe169745721b21245d2217d2c2453e and
  97de97daefc2ed084c91eff34af2426f2e55e134.
  
  Reported-by: Viktor Szakats
  Ref: https://github.com/curl/curl/commit/97de97daefc2ed084c91eff34af2426f2e55e134#commitcomment-33499044
  Closes https://github.com/curl/curl/pull/3868

Steve Holme (11 May 2019)
- http_ntlm: Corrected the name of the include guard
  
  Missed in f0bdd72c.
  
  Closes #3867

- http_digest: Don't expose functions when HTTP and Crypto Auth are disabled
  
  Closes #3861

- http_negotiate: Don't expose functions when HTTP is disabled

Daniel Stenberg (11 May 2019)
- SECURITY-PROCESS: fix links [ci skip]

Marcel Raad (11 May 2019)
- CMake: suppress unused variable warnings
  
  I missed these in commit d1b5cf830bfe169745721b21245d2217d2c2453e.

Daniel Stenberg (11 May 2019)
- doh: disable DOH for the cases it doesn't work
  
  Due to limitations in Curl_resolver_wait_resolv(), it doesn't work for
  DOH resolves. This fix disables DOH for those.
  
  Limitation added to KNOWN_BUGS.
  
  Fixes #3850
  Closes #3857

Jay Satiro (11 May 2019)
- checksrc.bat: Ignore snprintf warnings in docs/examples
  
  .. because we allow snprintf use in docs/examples.
  
  Closes https://github.com/curl/curl/pull/3862

Steve Holme (10 May 2019)
- vauth: Fix incorrect function description for Curl_auth_user_contains_domain()
  
  ...and misalignment of these comments. From a78c61a4.
  
  Closes #3860

Jay Satiro (10 May 2019)
- Revert "multi: support verbose conncache closure handle"
  
  This reverts commit b0972bc.
  
  - No longer show verbose output for the conncache closure handle.
  
  The offending commit was added so that the conncache closure handle
  would inherit verbose mode from the user's easy handle. (Note there is
  no way for the user to set options for the closure handle which is why
  that was necessary.) Other debug settings such as the debug function
  were not also inherited since we determined that could lead to crashes
  if the user's per-handle private data was used on an unexpected handle.
  
  The reporter here says he has a debug function to capture the verbose
  output, and does not expect or want any output to stderr; however
  because the conncache closure handle does not inherit the debug function
  the verbose output for that handle does go to stderr.
  
  There are other plausible scenarios as well such as the user redirects
  stderr on their handle, which is also not inherited since it could lead
  to crashes when used on an unexpected handle.
  
  Short of allowing the user to set options for the conncache closure
  handle I don't think there's much we can safely do except no longer
  inherit the verbose setting.
  
  Bug: https://curl.haxx.se/mail/lib-2019-05/0021.html
  Reported-by: Kristoffer Gleditsch
  
  Ref: https://github.com/curl/curl/pull/3598
  Ref: https://github.com/curl/curl/pull/3618
  
  Closes https://github.com/curl/curl/pull/3856

Steve Holme (10 May 2019)
- ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup()
  
  From 6012fa5a.
  
  Closes #3858

Daniel Stenberg (9 May 2019)
- BUG-BOUNTY: minor formatting fixes [ci skip]

- RELEASE-NOTES: synced

- BUG-BOUNTY.md: add the Dropbox "bonus" extra payout ability [ci skip]
  
  Closes #3839

Kamil Dudka (9 May 2019)
- http_negotiate: do not treat failure of gss_init_sec_context() as fatal
  
  Fixes #3726
  Closes #3849

- spnego_gssapi: fix return code on gss_init_sec_context() failure
  
  Fixes #3726
  Closes #3849

Steve Holme (9 May 2019)
- gen_resp_file.bat: Removed unnecessary @ from all but the first command
  
  There is need to use @ on every command once echo has been turned off.
  
  Closes #3854

Jay Satiro (8 May 2019)
- http: Ignore HTTP/2 prior knowledge setting for HTTP proxies
  
  - Do not switch to HTTP/2 for an HTTP proxy that is not tunnelling to
    the destination host.
  
  We already do something similar for HTTPS proxies by not sending h2. [1]
  
  Prior to this change setting CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE would
  incorrectly use HTTP/2 to talk to the proxy, which is not something we
  support (yet?). Also it's debatable whether or not that setting should
  apply to HTTP/2 proxies.
  
  [1]: https://github.com/curl/curl/commit/17c5d05
  
  Bug: https://github.com/curl/curl/issues/3570
  Bug: https://github.com/curl/curl/issues/3832
  
  Closes https://github.com/curl/curl/pull/3853

Marcel Raad (8 May 2019)
- travis: update mesalink build to xenial
  
  Closes https://github.com/curl/curl/pull/3842

Daniel Stenberg (8 May 2019)
- [Ricky Leverence brought this change]

  OpenSSL: Report -fips in version if OpenSSL is built with FIPS
  
  Older versions of OpenSSL report FIPS availabilty via an OPENSSL_FIPS
  define. It uses this define to determine whether to publish -fips at
  the end of the version displayed. Applications that utilize the version
  reported by OpenSSL will see a mismatch if they compare it to what curl
  reports, as curl is not modifying the version in the same way. This
  change simply adds a check to see if OPENSSL_FIPS is defined, and will
  alter the reported version to match what OpenSSL itself provides. This
  only appears to be applicable in versions of OpenSSL <1.1.1
  
  Closes #3771

Kamil Dudka (7 May 2019)
- [Frank Gevaerts brought this change]

  nss: allow fifos and character devices for certificates.
  
  Currently you can do things like --cert <(cat ./cert.crt) with (at least) the
  openssl backend, but that doesn't work for nss because is_file rejects fifos.
  
  I don't actually know if this is sufficient, nss might do things internally
  (like seeking back) that make this not work, so actual testing is needed.
  
  Closes #3807

Daniel Gustafsson (6 May 2019)
- test2100: Fix typos in test description

Daniel Stenberg (6 May 2019)
- ssh: define USE_SSH if SSH is enabled (any backend)
  
  Closes #3846

Steve Holme (5 May 2019)
- winbuild: Add our standard copyright header to the winbuild batch files

- makedebug: Fix ERRORLEVEL detection after running where.exe
  
  Closes #3838

Daniel Stenberg (5 May 2019)
- urlapi: add CURLUPART_ZONEID to set and get
  
  The zoneid can be used with IPv6 numerical addresses.
  
  Updated test 1560 to verify.
  
  Closes #3834

- [Taiyu Len brought this change]

  WRITEFUNCTION: add missing set_in_callback around callback
  
  Closes #3837

- RELEASE-NOTES: synced

- CURLMOPT_TIMERFUNCTION.3: warn about the recursive risk [ci skip]
  
  Reported-by: Ricardo Gomes
  
  Bug: #3537
  Closes #3836

- CURLOPT_CHUNK_BGN_FUNCTION.3: document the struct and time value
  
  The time field in the curl_fileinfo struct will always be zero. No code
  was ever implemented to actually convert the date string to a time_t.
  
  Fixes #3829
  Closes #3835

- OS400/ccsidcurl.c: code style fixes

- OS400/ccsidcurl: replace use of Curl_vsetopt
  
  (and make the code style comply)
  
  Fixes #3833

- urlapi: strip off scope id from numerical IPv6 addresses
  
  ... to make the host name "usable". Store the scope id and put it back
  when extracting a URL out of it.
  
  Also makes curl_url_set() syntax check CURLUPART_HOST.
  
  Fixes #3817
  Closes #3822

- RELEASE-NOTES: synced

- multiif.h: remove unused protos
  
  ... for functions related to pipelining. Those functions were removed in
  2f44e94efb3df.
  
  Closes #3828

- [Yiming Jing brought this change]

  travis: mesalink: temporarily disable test 3001
  
  ... due to SHA-1 signatures in test certs

- [Yiming Jing brought this change]

  travis: upgrade the MesaLink TLS backend to v1.0.0
  
  Closes #3823
  Closes #3776

- ConnectionExists: improve non-multiplexing use case
  
  - better log output
  
  - make sure multiplex is enabled for it to be used

- multi: provide Curl_multiuse_state to update information
  
  As soon as a TLS backend gets ALPN conformation about the specific HTTP
  version it can now set the multiplex situation for the "bundle" and
  trigger moving potentially queued up transfers to the CONNECT state.

- process_pending_handles: mark queued transfers as previously pending
  
  With transfers being queued up, we only move one at a a time back to the
  CONNECT state but now we mark moved transfers so that when a moved
  transfer is confirmed "successful" (it connected) it will trigger the
  move of another pending transfer. Previously, it would otherwise wait
  until the transfer was done before doing this. This makes queued up
  pending transfers get processed (much) faster.

- http: mark bundle as not for multiuse on < HTTP/2 response
  
  Fixes #3813
  Closes #3815

Daniel Gustafsson (1 May 2019)
- cookie: Guard against possible NULL ptr deref
  
  In case the name pointer isn't set (due to memory pressure most likely)
  we need to skip the prefix matching and reject with a badcookie to avoid
  a possible NULL pointer dereference.
  
  Closes #3820 #3821
  Reported-by: Jonathan Moerman
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Patrick Monnerat (30 Apr 2019)
- os400: Add CURLOPT_MAXAGE_CONN to ILE/RPG bindings

Kamil Dudka (29 Apr 2019)
- nss: provide more specific error messages on failed init
  
  Closes #3808

Daniel Stenberg (29 Apr 2019)
- [Reed Loden brought this change]

  docs: minor polish to the bug bounty / security docs
  
  Closes #3811

- CURL_MAX_INPUT_LENGTH: largest acceptable string input size
  
  This limits all accepted input strings passed to libcurl to be less than
  CURL_MAX_INPUT_LENGTH (8000000) bytes, for these API calls:
  curl_easy_setopt() and curl_url_set().
  
  The 8000000 number is arbitrary picked and is meant to detect mistakes
  or abuse, not to limit actual practical use cases. By limiting the
  acceptable string lengths we also reduce the risk of integer overflows
  all over.
  
  NOTE: This does not apply to `CURLOPT_POSTFIELDS`.
  
  Test 1559 verifies.
  
  Closes #3805

- [Tseng Jun brought this change]

  curlver.h: use parenthesis in CURL_VERSION_BITS macro
  
  Closes #3809

Marcel Raad (27 Apr 2019)
- [Simon Warta brought this change]

  cmake: rename CMAKE_USE_DARWINSSL to CMAKE_USE_SECTRANSP
  
  Closes https://github.com/curl/curl/pull/3769

Steve Holme (23 Apr 2019)
- ntlm: Missed pre-processor || (or) during rebase for cd15acd0

- ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4
  
  Just like we do for mbed TLS, use our local implementation of MD4 when
  OpenSSL doesn't support it. This allows a type-3 message to include the
  NT response.

Daniel Gustafsson (23 Apr 2019)
- INTERNALS: fix misindentation of ToC item
  
  Kerberos was incorrectly indented as a subsection under FTP, which is
  incorrect as they are both top level sections. A fix for this was first
  attempted in commit fef38a0898322f285401c5ff2f5e7c90dbf3be63 but that
  was a few paddles short of being complete.

- [Aron Bergman brought this change]

  INTERNALS: Add structs to ToC
  
  Add the subsections under "Structs in libcurl" to the table of contents.
  
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>
  Reviewed-by: Daniel Gustafsson <daniel@yesql.se>

- [Aron Bergman brought this change]

  INTERNALS: Add code highlighting
  
  Make all struct members under the Curl_handler section
  print in monospace font.
  
  Closes #3801
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>
  Reviewed-by: Daniel Gustafsson <daniel@yesql.se>

Daniel Stenberg (22 Apr 2019)
- docs/BUG-BOUNTY: bug bounty time [skip ci]
  
  Introducing the curl bug bounty program on hackerone. We now recommend
  filing security issues directly in the hackerone ticket system which
  only is readable to curl security team members.
  
  Assisted-by: Daniel Gustafsson
  
  Closes #3488

Steve Holme (22 Apr 2019)
- sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616
  
  RFC 4616 specifies the authzid is optional in the client authentication
  message and that the server will derive the authorisation identity
  (authzid) from the authentication identity (authcid) when not specified
  by the client.

Jay Satiro (22 Apr 2019)
- [Gisle Vanem brought this change]

  memdebug: fix variable name
  
  Follow-up to 76b6348 which renamed logfile as curl_dbg_logfile.
  
  Ref: https://github.com/curl/curl/commit/76b6348#r33259088

Steve Holme (21 Apr 2019)
- vauth/cleartext: Don't send the authzid if it is empty
  
  Follow up to 762a292f.

Daniel Stenberg (21 Apr 2019)
- test 196,197,198: add 'retry' keyword [skip ci]

- RELEASE-NOTES: synced

- CURLOPT_MAXAGE_CONN: set the maximum allowed age for conn reuse
  
  ... and disconnect too old ones instead of trying to reuse.
  
  Default max age is set to 118 seconds.
  
  Ref: #3722
  Closes #3782

Daniel Gustafsson (20 Apr 2019)
- [Po-Chuan Hsieh brought this change]

  altsvc: Fix building with cookies disables
  
  ALTSVC requires Curl_get_line which is defined in lib/cookie.c inside a #if
  check of HTTP and COOKIES. That makes Curl_get_line undefined if COOKIES is
  disabled. Fix by splitting out the function into a separate file which can
  be included where needed.
  
  Closes #3717
  Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
  Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>

Daniel Stenberg (20 Apr 2019)
- test1002: correct the name [skip ci]

- test660: verify CONNECT_ONLY with IMAP
  
  which basically just makes sure LOGOUT is *not* issued on disconnect

- Curl_disconnect: treat all CONNECT_ONLY connections as "dead"
  
  Since the connection has been used by the "outside" we don't know the
  state of it anymore and curl should not use it anymore.
  
  Bug: https://curl.haxx.se/mail/lib-2019-04/0052.html
  
  Closes #3795

- multi: fix the statenames (follow-up fix from 2f44e94efb3df8e)
  
  The list of names must be in sync with the defined states in the header
  file!

Steve Holme (16 Apr 2019)
- openvms: Remove pre-processors for Windows as VMS cannot support them

- openvms: Remove pre-processor for SecureTransport as VMS cannot support it
  
  Fixes #3768
  Closes #3785

Jay Satiro (16 Apr 2019)
- TODO: Add issue link to an existing entry

Daniel Stenberg (16 Apr 2019)
- RELEASE-NOTES: synced

Jay Satiro (16 Apr 2019)
- tool_help: Warn if curl and libcurl versions do not match
  
  .. because functionality may be affected if the versions differ.
  
  This commit implements TODO 18.7 "warning if curl version is not in sync
  with libcurl version".
  
  Ref: https://github.com/curl/curl/blob/curl-7_64_1/docs/TODO#L1028-L1033
  
  Closes https://github.com/curl/curl/pull/3774

Steve Holme (16 Apr 2019)
- md5: Update the function signature following d84da52d

- md5: Forgot to update the code alignment in d84da52d

- md5: Return CURLcode from the internally accessible functions
  
  Following 28f826b3 to return CURLE_OK instead of numeric 0.

Daniel Gustafsson (15 Apr 2019)
- tests: Run global cleanup at end of tests
  
  Make sure to run curl_global_cleanup() when shutting down the test
  suite to release any resources allocated in the SSL setup. This is
  clearly visible when running tests with PolarSSL where the thread
  lock calloc() memory which isn't released when not running cleanup.
  Below is an excerpt from the autobuild logs:
  
    ==12368== 96 bytes in 1 blocks are possibly lost in loss record 1 of 2
    ==12368== at 0x4837B65: calloc (vg_replace_malloc.c:752)
    ==12368== by 0x11A76E: curl_dbg_calloc (memdebug.c:205)
    ==12368== by 0x145CDF: Curl_polarsslthreadlock_thread_setup
                           (polarssl_threadlock.c:54)
    ==12368== by 0x145B37: Curl_polarssl_init (polarssl.c:865)
    ==12368== by 0x14129D: Curl_ssl_init (vtls.c:171)
    ==12368== by 0x118B4C: global_init (easy.c:158)
    ==12368== by 0x118BF5: curl_global_init (easy.c:221)
    ==12368== by 0x118D0B: curl_easy_init (easy.c:299)
    ==12368== by 0x114E96: test (lib1906.c:32)
    ==12368== by 0x115495: main (first.c:174)
  
  Closes #3783
  Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Marcel Raad (15 Apr 2019)
- travis: use mbedtls from Xenial
  
  No need to build it from source anymore.
  
  Closes https://github.com/curl/curl/pull/3779

- travis: use libpsl from Xenial
  
  This makes building libpsl and libidn2 from source unnecessary and
  removes the need for the autopoint and libunistring-dev packages.
  
  Closes https://github.com/curl/curl/pull/3779

Daniel Stenberg (15 Apr 2019)
- runtests: start socksd like other servers
  
  ... without a $srcdir prefix. Triggered by the failures in several
  autobuilds.
  
  Closes #3781

Daniel Gustafsson (14 Apr 2019)
- socksd: Fix typos
  
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

- socksd: Properly decorate static variables
  
  Mark global variables static to avoid compiler warning in Clang when
  using -Wmissing-variable-declarations.
  
  Closes #3778
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Steve Holme (14 Apr 2019)
- md(4|5): Fixed indentation oddities with the importation of replacement code
  
  The indentation from 211d5329 and 57d6d253 was a little strange as
  parts didn't align correctly, uses 4 spaces rather than 2. Checked
  the indentation of the original source so it aligns, albeit, using
  curl style.

- md5: Code style to return CURLE_OK rather than numeric 0

- md5: Corrected code style for some pointer arguments

Marcel Raad (13 Apr 2019)
- travis: update some builds to xenial
  
  Xenial comes with more up-to-date software versions and more available
  packages, some of which we currently build from source. Unfortunately,
  some builds would fail with Xenial because of assertion failures in
  Valgrind when using OpenSSL, so leave these at Trusty.
  
  Closes https://github.com/curl/curl/pull/3777

Daniel Stenberg (13 Apr 2019)
- test: make tests and test scripts use socksd for SOCKS
  
  Make all SOCKS tests use socksd instead of ssh.

- socksd: new SOCKS 4+5 server for tests
  
  Closes #3752

- singleipconnect: show port in the verbose "Trying ..." message
  
  To aid debugging better.

- [tmilburn brought this change]

  CURLOPT_ADDRESS_SCOPE: fix range check and more
  
  Commit 9081014 fixed most of the confusing issues between scope id and
  scope however 844896d added bad limits checking assuming that the scope
  is being set and not the scope id.
  
  I have fixed the documentation so it all refers to scope ids.
  
  In addition Curl_if2ip refered to the scope id as remote_scope_id which
  is incorrect, so I renamed it to local_scope_id.
  
  Adjusted-by: Daniel Stenberg
  
  Closes #3655
  Closes #3765
  Fixes #3713

- urlapi: stricter CURLUPART_PORT parsing
  
  Only allow well formed decimal numbers in the input.
  
  Document that the number MUST be between 1 and 65535.
  
  Add tests to test 1560 to verify the above.
  
  Ref: https://github.com/curl/curl/issues/3753
  Closes #3762

Jay Satiro (13 Apr 2019)
- [Jan Ehrhardt brought this change]

  winbuild: Support MultiSSL builds
  
  - Remove the lines in winbuild/Makefile.vc that generate an error with
    multiple SSL backends.
  
  - Add /DCURL_WITH_MULTI_SSL in winbuild/MakefileBuild.vc if multiple SSL
    backends are set.
  
  Closes https://github.com/curl/curl/pull/3772

Daniel Stenberg (12 Apr 2019)
- travis: remove mesalink builds (temporarily?)
  
  Since the mesalink build started to fail on travis, even though we build
  a fixed release version, we disable it to prevent it from blocking
  progress.
  
  Closes #3767

