RELEASE-NOTES: synced with ef60fdbd73

Just before 7.26.0 is about to ship
smtp: Fixed an issue with the multi-interface always sending postdata
2012-05-24 18:04:41 +02:00 · 2012-05-22 22:08:25 +01:00 · 2012-05-22 20:20:59 +01:00 · 2012-05-22 16:40:09 +02:00 · 2012-05-22 11:56:19 +02:00 · 2012-05-22 11:12:25 +02:00
262 changed files with 6105 additions and 3384 deletions
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -57,10 +57,6 @@ set(OS "\"${CMAKE_SYSTEM_NAME}\"")
 include_directories(${PROJECT_BINARY_DIR}/include/curl)
 include_directories( ${CURL_SOURCE_DIR}/include )

-if(WIN32)
-  set(NATIVE_WINDOWS ON)
-endif()
-
 option(BUILD_CURL_EXE "Set to ON to build cURL executable." ON)
 option(BUILD_CURL_TESTS "Set to ON to build cURL tests." ON)
 option(CURL_STATICLIB "Set to ON to build libcurl with static linking." OFF)
@@ -113,22 +109,11 @@ mark_as_advanced(CURL_DISABLE_HTTP)

 option(CURL_DISABLE_LDAPS "to disable LDAPS" OFF)
 mark_as_advanced(CURL_DISABLE_LDAPS)
-if(WIN32)
-  set(CURL_DEFAULT_DISABLE_LDAP OFF)
-  # some windows compilers do not have wldap32
-  if( NOT HAVE_WLDAP32)
-    set(CURL_DISABLE_LDAP ON CACHE BOOL "" FORCE)
-    message(STATUS "wldap32 not found CURL_DISABLE_LDAP set ON")
-    option(CURL_LDAP_WIN "Use Windows LDAP implementation" OFF)
-  else()
-    option(CURL_LDAP_WIN "Use Windows LDAP implementation" ON)
-  endif()
-  mark_as_advanced(CURL_LDAP_WIN)
-endif()

 if(HTTP_ONLY)
  set(CURL_DISABLE_FTP ON)
  set(CURL_DISABLE_LDAP ON)
+  set(CURL_DISABLE_LDAPS ON)
  set(CURL_DISABLE_TELNET ON)
  set(CURL_DISABLE_DICT ON)
  set(CURL_DISABLE_FILE ON)
@@ -148,9 +133,9 @@ option(ENABLE_IPV6 "Define if you want to enable IPv6 support" OFF)
 mark_as_advanced(ENABLE_IPV6)

 if(WIN32)
-  find_library(WSOCK32_LIBRARY wsock32)
-  find_library(WS2_32_LIBRARY ws2_32)
-  list_spaces_append_once(CMAKE_C_STANDARD_LIBRARIES ${WSOCK32_LIBRARY} ${WS2_32_LIBRARY})  # bufferoverflowu.lib
+  # Windows standard libraries are located in C:/Program Files/Microsoft SDKs/[...]
+  # They are already included in the default MSVC LIBPATH => no find_library is needed!
+  list_spaces_append_once(CMAKE_C_STANDARD_LIBRARIES wsock32.lib ws2_32.lib)  # bufferoverflowu.lib
  if(CURL_DISABLE_LDAP)
    # Remove wldap32.lib from space-separated list
    string(REPLACE " " ";" _LIST ${CMAKE_C_STANDARD_LIBRARIES})
@@ -221,6 +206,20 @@ check_library_exists_concat("ws2_32" getch        HAVE_LIBWS2_32)
 check_library_exists_concat("winmm"  getch        HAVE_LIBWINMM)
 check_library_exists("wldap32" cldap_open "" HAVE_WLDAP32)

+if(WIN32)
+  set(CURL_DEFAULT_DISABLE_LDAP OFF)
+  # some windows compilers do not have wldap32
+  if(NOT HAVE_WLDAP32)
+    set(CURL_DISABLE_LDAP ON CACHE BOOL "" FORCE)
+    message(STATUS "wldap32 not found CURL_DISABLE_LDAP set ON")
+    option(CURL_LDAP_WIN "Use Windows LDAP implementation" OFF)
+  else()
+    option(CURL_LDAP_WIN "Use Windows LDAP implementation" ON)
+  endif()
+  mark_as_advanced(CURL_LDAP_WIN)
+endif()
+
+
 # IF(NOT CURL_SPECIAL_LIBZ)
 #  CHECK_LIBRARY_EXISTS_CONCAT("z"      inflateEnd   HAVE_LIBZ)
 # ENDIF(NOT CURL_SPECIAL_LIBZ)
@@ -387,6 +386,13 @@ if(NOT HAVE_LDAP_H)
  set(CURL_DISABLE_LDAP ON CACHE BOOL "" FORCE)
 endif()

+# No ldap, no ldaps.
+if(CURL_DISABLE_LDAP)
+  if(NOT CURL_DISABLE_LDAPS)
+    message(STATUS "LDAP needs to be enabled to support LDAPS")
+    set(CURL_DISABLE_LDAPS ON CACHE BOOL "" FORCE)
+  endif()
+endif()

 check_type_size(size_t  SIZEOF_SIZE_T)
 check_type_size(ssize_t  SIZEOF_SSIZE_T)
@@ -426,7 +432,7 @@ if(SIZEOF_LONG EQUAL 8)
  set(CURL_FORMAT_CURL_OFF_TU "lu")
  set(CURL_FORMAT_OFF_T "%ld")
  set(CURL_SUFFIX_CURL_OFF_T L)
-  set(CURL_SUFFIX_CURL_OFF_TU LU)
+  set(CURL_SUFFIX_CURL_OFF_TU UL)
 endif(SIZEOF_LONG EQUAL 8)

 if(SIZEOF_LONG_LONG EQUAL 8)
@@ -436,7 +442,7 @@ if(SIZEOF_LONG_LONG EQUAL 8)
  set(CURL_FORMAT_CURL_OFF_TU "llu")
  set(CURL_FORMAT_OFF_T "%lld")
  set(CURL_SUFFIX_CURL_OFF_T LL)
-  set(CURL_SUFFIX_CURL_OFF_TU LLU)
+  set(CURL_SUFFIX_CURL_OFF_TU ULL)
 endif(SIZEOF_LONG_LONG EQUAL 8)

 if(NOT CURL_TYPEOF_CURL_OFF_T)
--- a/2
+++ b/2
@@ -1,6 +1,6 @@
 COPYRIGHT AND PERMISSION NOTICE

-Copyright (c) 1996 - 2011, Daniel Stenberg, <daniel@haxx.se>.
+Copyright (c) 1996 - 2012, Daniel Stenberg, <daniel@haxx.se>.

 All rights reserved.

--- a/185
+++ b/185
@@ -1,84 +1,54 @@
-Curl and libcurl 7.24.0
+Curl and libcurl 7.26.0

 Public curl releases:         127
- Command line options:         149
- curl_easy_setopt() options:   192
+ Command line options:         151
+ curl_easy_setopt() options:   199
 Public functions in libcurl:  58
 Known libcurl bindings:       39
- Contributors:                 907
-
-This release includes the following security fixes:
-
- o curl was vulnerable to a data injection attack for certain protocols
-   http://curl.haxx.se/docs/adv_20120124.html
- o curl was vulnerable to a SSL CBC IV vulnerability when built to use OpenSSL
-   http://curl.haxx.se/docs/adv_20120124B.html
+ Contributors:                 929

 This release includes the following changes:

- o CURLOPT_QUOTE: SFTP supports the '*'-prefix now [24]
- o CURLOPT_DNS_SERVERS: set name servers if possible [23]
- o Add support for using nettle instead of gcrypt as gnutls backend [22]
- o CURLOPT_INTERFACE: avoid resolving interfaces names with magic prefixes [21]
- o Added CURLOPT_ACCEPTTIMEOUT_MS [30]
- o configure: add symbols versioning option --enable-versioned-symbols [31]
+ o nss: the minimal supported version of NSS bumped to 3.12.x
+ o nss: human-readable names are now provided for NSS errors if available
+ o add a manual page for mk-ca-bundle
+ o added --post303 and the CURL_REDIR_POST_303 option for CURLOPT_POSTREDIR
+ o smtp: Add support for DIGEST-MD5 authentication
+ o pop3: Added support for additional pop3 commands

 This release includes the following bugfixes:

- o SSL session share: move the age counter to the share object [1]
- o -J -O: use -O name if no Content-Disposition header comes! [2]
- o protocol_connect: show verbose connect and set connect time [3]
- o query-part: ignore the URI part for given protocols [4]
- o gnutls: only translate winsock errors for old versions [5]
- o POP3: fix end of body detection [6]
- o POP3: detect when LIST returns no mails
- o TELNET: improved treatment of options [7]
- o configure: add support for pkg-config detection of libidn [8]
- o CyaSSL 2.0+ library initialization adjustment [9]
- o multi interface: only use non-NULL socker function pointer
- o call opensocket callback properly for active FTP
- o don't call close socket callback for sockets created with accept() [10]
- o differentiate better between host/proxy errors [11]
- o SSH: fix CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 and --hostpubmd5 [12]
- o multi: handle timeouts on DNS servers by checking for new sockets [13]
- o CURLOPT_DNS_SERVERS: fix return code
- o POP3: fixed escaped dot not being stripped out [14]
- o OpenSSL: check for the SSLv2 function in configure [15]
- o MakefileBuild: fix the static build [16]
- o create_conn: don't switch to HTTP protocol if tunneling is enabled [17]
- o multi interface: fix block when CONNECT_ONLY option is used [18]
- o Fix connection reuse for TLS upgraded connections [19]
- o multiple file upload with -F and custom type [20]
- o multi interface: active FTP connections are no longer blocking [25]
- o Android build fix [26]
- o timer: restore PRETRANSFER timing [27]
- o libcurl.m4: Fix quoting arguments of AC_LANG_PROGRAM [28]
- o appconnect time fixed for non-blocking connect ssl backends [29]
- o do not include SSL handshake into time spent waiting for 100-continue [32]
- o handle dns cache case insensitive
- o use new host name casing for subsequent HTTP requests [33]
- o CURLOPT_RESOLVE: avoid adding already present host names
- o SFTP mkdir: use correct permission [34]
- o resolve: don't leak pre-populated dns entries [35]
- o --retry: Retry transfers on timeout and DNS errors
- o negotiate with SSPI backend: use the correct buffer for input [36]
- o SFTP dir: increase buffer size counter to avoid cut off file names [37]
- o TFTP: fix resending (again) [38]
- o c-ares: don't include getaddrinfo-using code [39]
- o FTP: CURLE_PARTIAL_FILE will not close the control channel [40]
- o win32-threaded-resolver: stop using a dummy socket
- o OpenSSL: remove reference to openssl internal struct [41]
- o OpenSSL: SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option no longer enabled
- o OpenSSL: fix PKCS#12 certificate parsing related memory leak
- o OpenLDAP: fix LDAP connection phase memory leak [42]
- o Telnet: Use correct file descriptor for telnet upload
- o Telnet: Remove bogus optimisation of telnet upload
- o URL parse: user name with ipv6 numerical address
- o polarssl: show cipher suite name correctly with 1.1.0
- o polarssl: havege_rand is not present in version 1.1.0 WARNING, we still
-   use the old API which is said to be insecure. See
-   http://polarssl.org/trac/wiki/SecurityAdvisory201102
- o gnutls: enforced use of SSLv3 [43]
+ o nss: libcurl now uses NSS_InitContext() to prevent collisions if available
+   [1]
+ o URL parse: reject numerical IPv6 addresses outside brackets [4]
+ o MD5: fix OOM memory leak [5]
+ o OpenSSL cert: provide more details when cert check fails
+ o HTTP: empty chunked POST ended up in two zero size chunks [6]
+ o fixed a regression when curl resolved to multiple addresses and the first
+   isn't supported [7]
+ o -# progress meter: avoid superfluous updates and duplicate lines [8]
+ o headers: surround GCC attribute names with double underscores [9]
+ o PolarSSL: correct return code for CRL matches
+ o PolarSSL: include version number in version string
+ o PolarSSL: add support for asynchronous connect
+ o mk-ca-bundle: revert the LWP usage [12]
+ o IPv6 cookie domain: get rid of the first bracket before the second
+ o connect.c: return changed to CURLE_COULDNT_CONNECT when opensocket fails
+ o OpenSSL: Made cert hostname check conform to RFC 6125 [10]
+ o HTTP: reset expected DL/UL sizes on redirects [11]
+ o CMake: fix Windows LDAP/LDAPS option handling [2]
+ o CMake: fix MS Visual Studio x64 unsigned long long literal suffix [3]
+ o configure: update detection logic of getaddrinfo() thread-safeness
+ o configure: check for gethostbyname in the watt lib
+ o curl-config.1: fix curl-config usage in example [13]
+ o smtp: Fixed non-escaping of dot character at beginning of line
+ o MakefileBuild.vc: use the correct IDN variable
+ o autoconf: improve handling of versioned symbols
+ o curl.1: clarify -x usage
+ o curl: shorten user-agent
+ o smtp: issue with the multi-interface always sending postdata [14]
+ o compile error with GnuTLS+Nettle fixed
+ o winbuild: fix IPv6 enabled build

 This release includes the following known bugs:

@@ -87,60 +57,29 @@ This release includes the following known bugs:
 This release would not have looked like this without help, code, reports and
 advice from friends like these:

- Alejandro Alvarez Ayllon, Jason Glasgow, Jonas Schnelli, Mark Brand,
- Martin Storsjo, Yang Tse, Laurent Rabret, Jason Glasgow, Steve Holme,
- Reza Arbab, Jason Liu, Gokhan Sengun, Rob Ward, Dan Fandrich,
- Naveen Chandran, Ward Willats, Vladimir Grishchenko, Colin Hogben,
- Alessandro Ghedini, Cedric Deltheil, Toni Moreno, Bernhard Reutner-Fischer,
- Sven Wegener, Alex Vinnik, Kamil Dudka, Mamoru Tasaka, Patrice Guerin,
- Armel Asselin, Arthur Murray, Steve H Truong, Peter Sylvester,
- Johannes Bauer, Brandon Wang, Pierre Joye, Robert Schumann,
- Christian Grothoff, Nikos Mavrogiannopoulos
+ Andrei Cipu, Armel Asselin, Benjamin Johnson, Dag Ekengren, Dave Reisner,
+ Gokhan Sengun, Guenter Knauf, Jan Schaumann, Jonathan Nieder, Kamil Dudka,
+ Lijo Antony, Olaf Flebbe, Rodrigo Silva, Steve Holme, Tatsuhiro Tsujikawa,
+ Tim Heckman, Yang Tse, Arnaud Compan, Blaise Potard, Daniel Theron,
+ Michael Mueller, Michael Wallner, Tim Heckman, Roman Mamedov, Julian Taylor,
+ Claes Jakobsson, Pierre Chapuis, Jan Ehrhardt

        Thanks! (and sorry if I forgot to mention someone)

 References to bug reports and discussions on issues:

- [1] = http://curl.haxx.se/mail/lib-2011-11/0116.html
- [2] = http://curl.haxx.se/mail/archive-2011-11/0030.htm
- [3] = http://curl.haxx.se/mail/archive-2011-11/0035.html
- [4] = http://curl.haxx.se/mail/lib-2011-11/0218.html
- [5] = http://curl.haxx.se/mail/lib-2011-11/0267.html
- [6] = http://curl.haxx.se/mail/lib-2011-11/0279.html
- [7] = http://curl.haxx.se/mail/lib-2011-11/0247.html
- [8] = http://curl.haxx.se/mail/lib-2011-11/0294.html
- [9] = http://curl.haxx.se/bug/view.cgi?id=3442068
- [10] = http://curl.haxx.se/mail/lib-2011-12/0018.html
- [11] = http://curl.haxx.se/mail/archive-2011-12/0010.html
- [12] = http://curl.haxx.se/bug/view.cgi?id=3451592
- [13] = http://curl.haxx.se/mail/lib-2011-11/0371.html
- [14] = http://curl.haxx.se/mail/lib-2011-11/0368.html
- [15] = http://curl.haxx.se/mail/archive-2011-12/0012.html
- [16] = http://curl.haxx.se/mail/lib-2011-12/0063.html
- [17] = http://curl.haxx.se/mail/lib-2011-12/0010.html
- [18] = http://curl.haxx.se/mail/lib-2011-12/0070.html
- [19] = http://curl.haxx.se/mail/lib-2011-11/0022.html
- [20] = http://curl.haxx.se/mail/lib-2011-12/0121.html
- [21] = http://curl.haxx.se/mail/lib-2011-12/0107.html
- [22] = http://curl.haxx.se/mail/lib-2011-11/0164.html
- [23] = http://curl.haxx.se/mail/lib-2011-11/0067.html
- [24] = http://curl.haxx.se/mail/lib-2011-11/0205.html
- [25] = http://curl.haxx.se/mail/lib-2011-12/0179.html
- [26] = http://curl.haxx.se/mail/lib-2011-12/0215.html
- [27] = http://curl.haxx.se/mail/archive-2011-12/0022.html
- [28] = http://curl.haxx.se/mail/lib-2011-12/0218.html
- [29] = http://curl.haxx.se/mail/lib-2011-12/0211.html
- [30] = http://curl.haxx.se/libcurl/c/curl_easy_setopt.html#CURLOPTACCEPTTIMOUTMS
- [31] = http://curl.haxx.se/mail/lib-2011-12/0133.html
- [32] = https://bugzilla.redhat.com/767490
- [33] = http://curl.haxx.se/mail/lib-2011-12/0314.html
- [34] = http://curl.haxx.se/mail/lib-2011-12/0249.html
- [35] = http://curl.haxx.se/bug/view.cgi?id=3463121
- [36] = http://curl.haxx.se/bug/view.cgi?id=3466497
- [37] = http://curl.haxx.se/mail/lib-2011-12/0249.html
- [38] = http://curl.haxx.se/mail/lib-2012-01/0146.html
- [39] = http://curl.haxx.se/mail/lib-2012-01/0160.html
- [40] = http://curl.haxx.se/mail/lib-2012-01/0096.html
- [41] = http://curl.haxx.se/mail/lib-2012-01/0049.html
- [42] = http://curl.haxx.se/bug/view.cgi?id=3474308
- [43] = http://curl.haxx.se/mail/lib-2012-01/0225.html
+ [1] = https://bugzilla.redhat.com/738456
+ [2] = http://curl.haxx.se/mail/lib-2012-03/0278.html
+ [3] = http://curl.haxx.se/mail/lib-2012-03/0255.html
+ [4] = http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670126
+ [5] = http://curl.haxx.se/mail/lib-2012-04/0246.html
+ [6] = http://curl.haxx.se/mail/archive-2012-04/0060.html
+ [7] = http://curl.haxx.se/bug/view.cgi?id=3516508
+ [8] = http://curl.haxx.se/bug/view.cgi?id=3517418
+ [9] = http://curl.haxx.se/mail/lib-2012-04/0127.html
+ [10] = http://tools.ietf.org/html/rfc6125#section-6.4.3
+ [11] = http://curl.haxx.se/bug/view.cgi?id=3510057
+ [12] = http://curl.haxx.se/mail/lib-2012-03/0238.html
+ [13] = http://curl.haxx.se/bug/view.cgi?id=3528241
+ [14] = http://curl.haxx.se/mail/lib-2012-05/0108.html
+ 
--- a/13
+++ b/13
@@ -1,11 +1,10 @@
-To be addressed in 7.22.1
-=========================
+To be addressed in 7.27
+=======================

-295 - "RTSP Authentication (#22)" https://github.com/bagder/curl/pull/22
+309 - metalink support for the curl tool

-296 - "OOM leak in multi code" (by Dan Fandrich)
+310 - a new authentication callback

-300 - "Polling on stray socket on sequential transfers." Andrew S
-      http://curl.haxx.se/mail/lib-2011-07/0053.html
+311 - support for SSPI schannel for SSL on windows

-308 -
+312 - 
--- a/acinclude.m4
+++ b/acinclude.m4
@@ -5,7 +5,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+# Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -228,12 +228,7 @@ AC_DEFUN([CURL_CHECK_NATIVE_WINDOWS], [
      ])
    fi
  ])
-  case "$ac_cv_native_windows" in
-    yes)
-      AC_DEFINE_UNQUOTED(NATIVE_WINDOWS, 1,
-        [Define to 1 if you are building a native Windows target.])
-      ;;
-  esac
+  AM_CONDITIONAL(DOING_NATIVE_WINDOWS, test "x$ac_cv_native_windows" = xyes)
 ])


--- a/5
+++ b/5
@@ -6,7 +6,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+# Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -384,9 +384,6 @@ $PERL -i.bak -pe 's/\bmv +([^-\s])/mv -f $1/g' aclocal.m4
 echo "buildconf: running autoheader"
 ${AUTOHEADER:-autoheader} || die "autoheader command failed"

-echo "buildconf: cp lib/curl_config.h.in src/curl_config.h.in"
-cp lib/curl_config.h.in src/curl_config.h.in
-
 echo "buildconf: running autoconf"
 ${AUTOCONF:-autoconf} || die "autoconf command failed"

--- a/buildconf.bat
+++ b/buildconf.bat
@@ -27,11 +27,6 @@ if not exist include\curl\curlbuild.h.dist goto end_curlbuild_h
 copy /Y include\curl\curlbuild.h.dist include\curl\curlbuild.h
 :end_curlbuild_h

-REM create src\config-win32.h
-if not exist lib\config-win32.h goto end_config_win32_h
-copy /Y lib\config-win32.h src\config-win32.h
-:end_config_win32_h
-
 REM setup c-ares git tree
 if not exist ares\buildconf.bat goto end_c_ares
 cd ares
--- a/configure.ac
+++ b/configure.ac
@@ -5,7 +5,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+# Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -35,7 +35,7 @@ This configure script may be copied, distributed and modified under the
 terms of the curl license; see COPYING for more details])

 AC_CONFIG_SRCDIR([lib/urldata.h])
-AM_CONFIG_HEADER(lib/curl_config.h src/curl_config.h include/curl/curlbuild.h)
+AM_CONFIG_HEADER(lib/curl_config.h include/curl/curlbuild.h)
 AC_CONFIG_MACRO_DIR([m4])
 AM_MAINTAINER_MODE

@@ -44,6 +44,7 @@ CURL_CHECK_OPTION_OPTIMIZE
 CURL_CHECK_OPTION_WARNINGS
 CURL_CHECK_OPTION_WERROR
 CURL_CHECK_OPTION_CURLDEBUG
+CURL_CHECK_OPTION_SYMBOL_HIDING
 CURL_CHECK_OPTION_ARES

 CURL_CHECK_PATH_SEPARATOR_REQUIRED
@@ -155,6 +156,7 @@ curl_tls_srp_msg="no      (--enable-tls-srp)"
   curl_ipv6_msg="no      (--enable-ipv6)"
    curl_idn_msg="no      (--with-libidn)"
 curl_manual_msg="no      (--enable-manual)"
+curl_libcurl_msg="enabled (--disable-libcurl-option)"
 curl_verbose_msg="enabled (--disable-verbose)"
   curl_sspi_msg="no      (--enable-sspi)"
   curl_ldap_msg="no      (--enable-ldap / --with-ldap-lib / --with-lber-lib)"
@@ -235,21 +237,18 @@ esac
 AC_MSG_RESULT($mimpure)
 AM_CONDITIONAL(MIMPURE, test x$mimpure = xyes)

-dnl 'STATICLIB' is, in spite of its name, not generic but only for static-only
-dnl builds on Windows
-AM_CONDITIONAL(STATICLIB, false)
-
 AC_MSG_CHECKING([if we need BUILDING_LIBCURL])
+use_cppflag_building_libcurl="no"
+use_cppflag_curl_staticlib="no"
 case $host in
  *-*-mingw*)
-    AC_DEFINE(BUILDING_LIBCURL, 1, [when building libcurl itself])
    AC_MSG_RESULT(yes)
+    use_cppflag_building_libcurl="yes"
    AC_MSG_CHECKING([if we need CURL_STATICLIB])
    if test "X$enable_shared" = "Xno"
    then
-      AC_DEFINE(CURL_STATICLIB, 1, [when not building a shared library])
      AC_MSG_RESULT(yes)
-      AM_CONDITIONAL(STATICLIB, true)
+      use_cppflag_curl_staticlib="yes"
    else
      AC_MSG_RESULT(no)
    fi
@@ -258,6 +257,8 @@ case $host in
    AC_MSG_RESULT(no)
    ;;
 esac
+AM_CONDITIONAL(USE_CPPFLAG_BUILDING_LIBCURL, test x$use_cppflag_building_libcurl = xyes)
+AM_CONDITIONAL(USE_CPPFLAG_CURL_STATICLIB, test x$use_cppflag_curl_staticlib = xyes)

 # Determine whether all dependent libraries must be specified when linking
 if test "X$enable_shared" = "Xyes" -a "X$link_all_deplibs" = "Xno"
@@ -299,6 +300,7 @@ fi

 CURL_CHECK_COMPILER_HALT_ON_ERROR
 CURL_CHECK_COMPILER_ARRAY_SIZE_NEGATIVE
+CURL_CHECK_COMPILER_SYMBOL_HIDING

 CURL_CHECK_NO_UNDEFINED
 AM_CONDITIONAL(NO_UNDEFINED, test x$need_no_undefined = xyes)
@@ -651,6 +653,25 @@ AC_HELP_STRING([--disable-manual],[Disable built-in manual]),
 dnl The actual use of the USE_MANUAL variable is done much later in this
 dnl script to allow other actions to disable it as well.

+dnl ************************************************************
+dnl disable C code generation support
+dnl
+AC_MSG_CHECKING([whether to enable generation of C code])
+AC_ARG_ENABLE(libcurl_option,
+AC_HELP_STRING([--enable-libcurl-option],[Enable --libcurl C code generation support])
+AC_HELP_STRING([--disable-libcurl-option],[Disable --libcurl C code generation support]),
+[ case "$enableval" in
+  no)
+       AC_MSG_RESULT(no)
+       AC_DEFINE(CURL_DISABLE_LIBCURL_OPTION, 1, [to disable --libcurl C code generation option])
+       curl_libcurl_msg="no"
+       ;;
+  *)   AC_MSG_RESULT(yes)
+       ;;
+  esac ],
+       AC_MSG_RESULT(yes)
+)
+
 dnl **********************************************************************
 dnl Checks for libraries.
 dnl **********************************************************************
@@ -676,6 +697,17 @@ then
               ])
 fi

+if test "$HAVE_GETHOSTBYNAME" != "1"
+then
+  dnl gethostbyname in the watt lib?
+  AC_CHECK_LIB(watt, gethostbyname,
+               [HAVE_GETHOSTBYNAME="1"
+               CPPFLAGS="-I/dev/env/WATT_ROOT/inc"
+               LDFLAGS="-L/dev/env/WATT_ROOT/lib"
+               LIBS="$LIBS -lwatt"
+               ])
+fi
+
 dnl At least one system has been identified to require BOTH nsl and socket
 dnl libs at the same time to link properly.
 if test "$HAVE_GETHOSTBYNAME" != "1"
@@ -1548,10 +1580,11 @@ if test X"$OPT_SSL" != Xno; then
       dnl when the ssl shared libs were found in a path that the run-time
       dnl linker doesn't search through, we need to add it to LD_LIBRARY_PATH
       dnl to prevent further configure tests to fail due to this
-
-       LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$LIB_OPENSSL"
-       export LD_LIBRARY_PATH
-       AC_MSG_NOTICE([Added $LIB_OPENSSL to LD_LIBRARY_PATH])
+       if test "x$cross_compiling" != "xyes"; then
+         LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$LIB_OPENSSL"
+         export LD_LIBRARY_PATH
+         AC_MSG_NOTICE([Added $LIB_OPENSSL to LD_LIBRARY_PATH])
+       fi
    fi
    CURL_CHECK_OPENSSL_API
  fi
@@ -1787,10 +1820,11 @@ if test "$OPENSSL_ENABLED" != "1"; then
          dnl linker doesn't search through, we need to add it to
          dnl LD_LIBRARY_PATH to prevent further configure tests to fail
          dnl due to this
-
-          LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$gtlslib"
-          export LD_LIBRARY_PATH
-          AC_MSG_NOTICE([Added $gtlslib to LD_LIBRARY_PATH])
+          if test "x$cross_compiling" != "xyes"; then 
+            LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$gtlslib"
+            export LD_LIBRARY_PATH
+            AC_MSG_NOTICE([Added $gtlslib to LD_LIBRARY_PATH])
+          fi
        fi
      fi

@@ -1824,6 +1858,9 @@ if test "$GNUTLS_ENABLED" = "1"; then
  if test "$USE_GNUTLS_NETTLE" = "1"; then
    AC_DEFINE(USE_GNUTLS_NETTLE, 1, [if GnuTLS uses nettle as crypto backend])
    AC_SUBST(USE_GNUTLS_NETTLE, [1])
+    LIBS="$LIBS -lnettle"
+  else
+    LIBS="$LIBS -lgcrypt"
  fi
 fi

@@ -1910,12 +1947,12 @@ if test "$OPENSSL_ENABLED" != "1"; then
        dnl linker doesn't search through, we need to add it to
        dnl LD_LIBRARY_PATH to prevent further configure tests to fail
        dnl due to this
-
-        LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$polarssllib"
-        export LD_LIBRARY_PATH
-        AC_MSG_NOTICE([Added $polarssllib to LD_LIBRARY_PATH])
+        if test "x$cross_compiling" != "xyes"; then
+          LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$polarssllib"
+          export LD_LIBRARY_PATH
+          AC_MSG_NOTICE([Added $polarssllib to LD_LIBRARY_PATH])
+        fi
      fi
-
    fi

  fi dnl PolarSSL not disabled
@@ -1932,7 +1969,7 @@ OPT_CYASSL=no
 _cppflags=$CPPFLAGS
 _ldflags=$LDFLAGS
 AC_ARG_WITH(cyassl,dnl
-AC_HELP_STRING([--with-cyassl=PATH],[where to look for CyaSSL, PATH points to the installation root (default: /usr/local/cyassl)])
+AC_HELP_STRING([--with-cyassl=PATH],[where to look for CyaSSL, PATH points to the installation root (default: system lib default)])
 AC_HELP_STRING([--without-cyassl], [disable CyaSSL detection]),
  OPT_CYASSL=$withval)

@@ -1945,14 +1982,9 @@ if test "$OPENSSL_ENABLED" != "1"; then
    fi

    if test -z "$OPT_CYASSL" ; then
-      dnl check for lib in default first
+      dnl check for lib in system default first

-      trycyassldir="/usr/local/cyassl"
-
-      LDFLAGS="$LDFLAGS -L$trycyassldir/lib"
-      CPPFLAGS="$CPPFLAGS -I$trycyassldir/include"
-
-      AC_CHECK_LIB(cyassl, InitCyaSSL,
+      AC_CHECK_LIB(cyassl, CyaSSL_Init,
      dnl libcyassl found, set the variable
       [
         AC_DEFINE(USE_CYASSL, 1, [if CyaSSL is enabled])
@@ -1974,7 +2006,7 @@ if test "$OPENSSL_ENABLED" != "1"; then
         CPPFLAGS="$CPPFLAGS $addcflags"
      fi

-      AC_CHECK_LIB(cyassl, InitCyaSSL,
+      AC_CHECK_LIB(cyassl, CyaSSL_Init,
       [
       AC_DEFINE(USE_CYASSL, 1, [if CyaSSL is enabled])
       AC_SUBST(USE_CYASSL, [1])
@@ -1999,10 +2031,11 @@ if test "$OPENSSL_ENABLED" != "1"; then
        dnl linker doesn't search through, we need to add it to
        dnl LD_LIBRARY_PATH to prevent further configure tests to fail
        dnl due to this
-
-        LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$cyassllib"
-        export LD_LIBRARY_PATH
-        AC_MSG_NOTICE([Added $cyassllib to LD_LIBRARY_PATH])
+        if test "x$cross_compiling" != "xyes"; then
+          LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$cyassllib"
+          export LD_LIBRARY_PATH
+          AC_MSG_NOTICE([Added $cyassllib to LD_LIBRARY_PATH])
+        fi
      fi

    fi
@@ -2058,13 +2091,6 @@ if test "$OPENSSL_ENABLED" != "1" -a "$GNUTLS_ENABLED" != "1"; then
        nssprefix=$OPT_NSS
    fi

-    dnl Check for functionPK11_CreateGenericObject
-    dnl this is needed for using the PEM PKCS#11 module
-    AC_CHECK_LIB(nss3, PK11_CreateGenericObject,
-     [
-     AC_DEFINE(HAVE_PK11_CREATEGENERICOBJECT, 1, [if you have the function PK11_CreateGenericObject])
-     AC_SUBST(HAVE_PK11_CREATEGENERICOBJECT, [1])
-     ])
    if test -n "$addlib"; then

      CLEANLIBS="$LIBS"
@@ -2075,7 +2101,8 @@ if test "$OPENSSL_ENABLED" != "1" -a "$GNUTLS_ENABLED" != "1"; then
         CPPFLAGS="$CPPFLAGS $addcflags"
      fi

-      AC_CHECK_LIB(nss3, NSS_Initialize,
+      dnl The function PK11_CreateGenericObject is needed to load libnsspem.so
+      AC_CHECK_LIB(nss3, PK11_CreateGenericObject,
       [
       AC_DEFINE(USE_NSS, 1, [if NSS is enabled])
       AC_SUBST(USE_NSS, [1])
@@ -2091,14 +2118,23 @@ if test "$OPENSSL_ENABLED" != "1" -a "$GNUTLS_ENABLED" != "1"; then
      if test "x$USE_NSS" = "xyes"; then
        AC_MSG_NOTICE([detected NSS version $version])

+        dnl NSS_InitContext() was introduced in NSS 3.12.5 and helps to prevent
+        dnl collisions on NSS initialization/shutdown with other libraries
+        AC_CHECK_FUNC(NSS_InitContext,
+        [
+          AC_DEFINE(HAVE_NSS_INITCONTEXT, 1, [if you have the NSS_InitContext function])
+          AC_SUBST(HAVE_NSS_INITCONTEXT, [1])
+        ])
+
        dnl when shared libs were found in a path that the run-time
        dnl linker doesn't search through, we need to add it to
        dnl LD_LIBRARY_PATH to prevent further configure tests to fail
        dnl due to this
-
-        LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$nssprefix/lib$libsuff"
-        export LD_LIBRARY_PATH
-        AC_MSG_NOTICE([Added $nssprefix/lib$libsuff to LD_LIBRARY_PATH])
+        if test "x$cross_compiling" != "xyes"; then
+          LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$nssprefix/lib$libsuff"
+          export LD_LIBRARY_PATH
+          AC_MSG_NOTICE([Added $nssprefix/lib$libsuff to LD_LIBRARY_PATH])
+        fi
      fi

    fi
@@ -2255,10 +2291,11 @@ if test X"$OPT_LIBSSH2" != Xno; then
       dnl libssh2_session_handshake was added in 1.2.8
       AC_CHECK_FUNCS( libssh2_version libssh2_init libssh2_exit \
                       libssh2_scp_send64 libssh2_session_handshake)
-
-       LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$DIR_SSH2"
-       export LD_LIBRARY_PATH
-       AC_MSG_NOTICE([Added $DIR_SSH2 to LD_LIBRARY_PATH])
+       if test "x$cross_compiling" != "xyes"; then
+         LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$DIR_SSH2"
+         export LD_LIBRARY_PATH
+         AC_MSG_NOTICE([Added $DIR_SSH2 to LD_LIBRARY_PATH])
+       fi
    fi
  else
    dnl no libssh2, revert back to clean variables
@@ -2350,41 +2387,37 @@ dnl **********************************************************************
 dnl Check for linker switch for versioned symbols
 dnl **********************************************************************

-AC_MSG_CHECKING([if libraries can be versioned])
-GLD=`$LD --help < /dev/null 2>/dev/null | grep version-script`
-if test -z "$GLD"; then
-    versioned_symbols_flavour=
-    AC_MSG_RESULT(no)
-    AC_MSG_WARN(***
-*** You need an ld version supporting the --version-script option.
-)
-else
-    AC_MSG_RESULT(yes)
-
-AC_MSG_CHECKING([whether versioned symbols are wanted])
 versioned_symbols_flavour=
-
+AC_MSG_CHECKING([whether versioned symbols are wanted])
 AC_ARG_ENABLE(versioned-symbols,
 AC_HELP_STRING([--enable-versioned-symbols], [Enable versioned symbols in shared library])
 AC_HELP_STRING([--disable-versioned-symbols], [Disable versioned symbols in shared library]),
 [ case "$enableval" in
  yes) AC_MSG_RESULT(yes)
-    if test "x$OPENSSL_ENABLED" = "x1"; then
-      versioned_symbols_flavour="OPENSSL_"
-    elif test "x$GNUTLS_ENABLED" == "x1"; then
-      versioned_symbols_flavour="GNUTLS_"
-    elif test "x$NSS_ENABLED" == "x1"; then
-      versioned_symbols_flavour="NSS_"
-    elif test "x$POLARSSL_ENABLED" == "x1"; then
-      versioned_symbols_flavour="POLARSSL_"
-    elif test "x$CYASSL_ENABLED" == "x1"; then
-      versioned_symbols_flavour="CYASSL_"
-    elif test "x$AXTLS_ENABLED" == "x1"; then
-      versioned_symbols_flavour="AXTLS_"
+    AC_MSG_CHECKING([if libraries can be versioned])
+    GLD=`$LD --help < /dev/null 2>/dev/null | grep version-script`
+    if test -z "$GLD"; then
+        AC_MSG_RESULT(no)
+        AC_MSG_WARN([You need an ld version supporting the --version-script option])
    else
-      versioned_symbols_flavour=""
+        AC_MSG_RESULT(yes)
+        if test "x$OPENSSL_ENABLED" = "x1"; then
+          versioned_symbols_flavour="OPENSSL_"
+        elif test "x$GNUTLS_ENABLED" == "x1"; then
+          versioned_symbols_flavour="GNUTLS_"
+        elif test "x$NSS_ENABLED" == "x1"; then
+          versioned_symbols_flavour="NSS_"
+        elif test "x$POLARSSL_ENABLED" == "x1"; then
+          versioned_symbols_flavour="POLARSSL_"
+        elif test "x$CYASSL_ENABLED" == "x1"; then
+          versioned_symbols_flavour="CYASSL_"
+        elif test "x$AXTLS_ENABLED" == "x1"; then
+          versioned_symbols_flavour="AXTLS_"
+        else
+          versioned_symbols_flavour=""
+        fi
+        versioned_symbols="yes"
    fi
-    versioned_symbols="yes"
    ;;

  *)   AC_MSG_RESULT(no)
@@ -2394,7 +2427,6 @@ AC_HELP_STRING([--disable-versioned-symbols], [Disable versioned symbols in shar
 AC_MSG_RESULT(no)
 ]
 )
-fi

 AC_SUBST(VERSIONED_FLAVOUR, ["$versioned_symbols_flavour"])
 AM_CONDITIONAL(VERSIONED_SYMBOLS, test "x$versioned_symbols" = "xyes")
@@ -3027,48 +3059,9 @@ AC_HELP_STRING([--disable-cookies],[Disable cookies support]),
 )

 dnl ************************************************************
-dnl Enable hiding of internal symbols in library to reduce its size and
-dnl speed dynamic linking of applications.  This currently is only supported
-dnl on gcc >= 4.0 and SunPro C.
+dnl hiding of library internal symbols
 dnl
-AC_MSG_CHECKING([whether to enable hidden symbols in the library])
-AC_ARG_ENABLE(hidden-symbols,
-AC_HELP_STRING([--enable-hidden-symbols],[Hide internal symbols in library])
-AC_HELP_STRING([--disable-hidden-symbols],[Leave all symbols with default visibility in library]),
-[ case "$enableval" in
-  no)
-       AC_MSG_RESULT(no)
-       ;;
-  *)
-       AC_MSG_CHECKING([whether $CC supports it])
-       if test "$GCC" = yes ; then
-         if $CC --help --verbose 2>&1 | grep fvisibility= > /dev/null ||
-           dnl clang always supports -fvisibility= but it doesn't show up
-           dnl under --help.
-           test "$compiler_id" = "CLANG"; then
-           AC_MSG_RESULT(yes)
-           AC_DEFINE(CURL_HIDDEN_SYMBOLS, 1, [to enable hidden symbols])
-           AC_DEFINE(CURL_EXTERN_SYMBOL, [__attribute__ ((visibility ("default")))], [to make a symbol visible])
-           CFLAGS="$CFLAGS -fvisibility=hidden"
-         else
-            AC_MSG_RESULT(no)
-          fi
-
-       else
-         dnl Test for SunPro cc
-         if $CC 2>&1 | grep flags >/dev/null && $CC -flags | grep xldscope= >/dev/null ; then
-           AC_MSG_RESULT(yes)
-           AC_DEFINE(CURL_HIDDEN_SYMBOLS, 1, [to enable hidden symbols])
-           AC_DEFINE(CURL_EXTERN_SYMBOL, [__global], [to make a symbol visible])
-           CFLAGS="$CFLAGS -xldscope=hidden"
-         else
-           AC_MSG_RESULT(no)
-         fi
-       fi
-       ;;
-  esac ],
-       AC_MSG_RESULT(no)
-)
+CURL_CONFIGURE_SYMBOL_HIDING

 dnl ************************************************************
 dnl enforce SONAME bump
@@ -3298,31 +3291,32 @@ CURL_GENERATE_CONFIGUREHELP_PM

 AC_MSG_NOTICE([Configured to build curl/libcurl:

-  curl version:    ${CURLVERSION}
-  Host setup:      ${host}
-  Install prefix:  ${prefix}
-  Compiler:        ${CC}
-  SSL support:     ${curl_ssl_msg}
-  SSH support:     ${curl_ssh_msg}
-  zlib support:    ${curl_zlib_msg}
-  krb4 support:    ${curl_krb4_msg}
-  GSSAPI support:  ${curl_gss_msg}
-  SPNEGO support:  ${curl_spnego_msg}
-  TLS-SRP support: ${curl_tls_srp_msg}
-  resolver:        ${curl_res_msg}
-  ipv6 support:    ${curl_ipv6_msg}
-  IDN support:     ${curl_idn_msg}
-  Build libcurl:   Shared=${enable_shared}, Static=${enable_static}
-  Built-in manual: ${curl_manual_msg}
-  Verbose errors:  ${curl_verbose_msg}
-  SSPI support:    ${curl_sspi_msg}
-  ca cert bundle:  ${ca}
-  ca cert path:    ${capath}
-  LDAP support:    ${curl_ldap_msg}
-  LDAPS support:   ${curl_ldaps_msg}
-  RTSP support:    ${curl_rtsp_msg}
-  RTMP support:    ${curl_rtmp_msg}
-  Protocols:       ${SUPPORT_PROTOCOLS}
+  curl version:     ${CURLVERSION}
+  Host setup:       ${host}
+  Install prefix:   ${prefix}
+  Compiler:         ${CC}
+  SSL support:      ${curl_ssl_msg}
+  SSH support:      ${curl_ssh_msg}
+  zlib support:     ${curl_zlib_msg}
+  krb4 support:     ${curl_krb4_msg}
+  GSSAPI support:   ${curl_gss_msg}
+  SPNEGO support:   ${curl_spnego_msg}
+  TLS-SRP support:  ${curl_tls_srp_msg}
+  resolver:         ${curl_res_msg}
+  ipv6 support:     ${curl_ipv6_msg}
+  IDN support:      ${curl_idn_msg}
+  Build libcurl:    Shared=${enable_shared}, Static=${enable_static}
+  Built-in manual:  ${curl_manual_msg}
+  --libcurl option: ${curl_libcurl_msg}
+  Verbose errors:   ${curl_verbose_msg}
+  SSPI support:     ${curl_sspi_msg}
+  ca cert bundle:   ${ca}
+  ca cert path:     ${capath}
+  LDAP support:     ${curl_ldap_msg}
+  LDAPS support:    ${curl_ldaps_msg}
+  RTSP support:     ${curl_rtsp_msg}
+  RTMP support:     ${curl_rtmp_msg}
+  Protocols:        ${SUPPORT_PROTOCOLS}
 ])

 if test "x$soname_bump" = "xyes"; then
--- a/curl-config.in
+++ b/curl-config.in
@@ -142,9 +142,9 @@ while test $# -gt 0; do
 	   CURLLIBDIR=""
 	fi
 	if test "X@REQUIRE_LIB_DEPS@" = "Xyes"; then
-	  echo ${CURLLIBDIR}-lcurl @LDFLAGS@ @LIBCURL_LIBS@ @LIBS@
+	  echo ${CURLLIBDIR}-lcurl @LIBCURL_LIBS@ @LIBS@
 	else
-	  echo ${CURLLIBDIR}-lcurl @LDFLAGS@ @LIBS@
+	  echo ${CURLLIBDIR}-lcurl @LIBS@
 	fi
 	;;

--- a/docs/CONTRIBUTE
+++ b/docs/CONTRIBUTE
@@ -34,6 +34,7 @@
 3.3 How To Make a Patch without git
 3.4 How to get your changes into the main sources
 3.5 Write good commit messages
+ 3.6 Please don't send pull requests

 ==============================================================================

@@ -276,3 +277,27 @@
 and make sure that you have your own user and email setup correctly in git
 before you commit

+3.6 Please don't send pull requests
+
+ With git (and expecially github) it is easy and tempting to send a pull
+ request to one or more people in the curl project to have changes merged this
+ way instead of mailing patches to the curl-library mailing list.
+
+ We don't like that. We want them mailed for these reasons:
+
+ - Peer review. Anyone and everyone on the list can review, comment and
+   improve on the patch. Pull requests limit this ability.
+
+ - Anyone can merge the patch into their own trees for testing and those who
+   have push rights can push it to the main repo. It doesn't have to be anyone
+   the patch author knows beforehand.
+
+ - Commit messages can be tweaked and changed if merged locally instead of
+   using github. Merges directly on github requires the changes to be perfect
+   already, which they seldomly are.
+
+ - Merges on github prevents rebases and even enforces --no-ff which is a git
+   style we don't otherwise use in the project
+
+ However: once patches have been reviewed and deemed fine on list they are
+ perfectly OK to be pulled from a published git tree.
--- a/docs/FAQ
+++ b/docs/FAQ
@@ -306,41 +306,10 @@ FAQ
  We don't know how many users that downloaded or installed curl and then
  never use it.

-  Some facts to use as input to the math:
+  In May 2012 Daniel did a counting game and came up with a number that may
+  be completely wrong or somewhat accurate. 300 million!

-  curl packages are downloaded from the curl.haxx.se and mirrors over a
-  million times per year. curl is installed by default with most Linux
-  distributions. curl is installed by default with Mac OS X. curl and libcurl
-  as used by numerous applications that include libcurl binaries in their
-  distribution packages (like Adobe Acrobat Reader and Google Earth).
-
-  More than a hundred known named companies use curl in commercial
-  environments and products and more than a hundred known named open source
-  projects depend on (lib)curl.
-
-  In a poll on the curl web site mid-2005, more than 50% of the 300+ answers
-  estimated a user base of one million users or more.
-
-  In March 2005, the "Linux Counter project" estimated a total Linux user base
-  of some 29 millions, while Netcraft detected some 4 million "active" Linux
-  based web servers. A guess is that a fair amount of these Linux
-  installations have curl installed.
-
-  The Debian project maintains statistics on packages installed by people
-  who have voluntarily run their package counting application.  In mid-2010,
-  libcurl3 was installed on over 55000 such systems (62% of reporting systems)
-  and was one of the 320 most popular installed packages (out of about 107000
-  possible packages).
-
-  All this taken together, there is no doubt that there are millions of
-  (lib)curl users.
-
-  http://curl.haxx.se/docs/companies.html
-  http://curl.haxx.se/docs/programs.html
-  http://curl.haxx.se/libcurl/using/apps.html
-  http://counter.li.org/estimates.php
-  http://news.netcraft.com/archives/2005/03/14/fedora_makes_rapid_progress.html
-  http://qa.debian.org/popcon.php?package=curl
+  See http://daniel.haxx.se/blog/2012/05/16/300m-users/

  1.11 Why don't you update ca-bundle.crt

--- a/docs/INSTALL
+++ b/docs/INSTALL
@@ -217,9 +217,9 @@ Win32
   adjust as necessary. It is also possible to override these paths with
   environment variables, for example:

-     set ZLIB_PATH=c:\zlib-1.2.5
-     set OPENSSL_PATH=c:\openssl-0.9.8r
-     set LIBSSH2_PATH=c:\libssh2-1.2.8
+     set ZLIB_PATH=c:\zlib-1.2.7
+     set OPENSSL_PATH=c:\openssl-0.9.8x
+     set LIBSSH2_PATH=c:\libssh2-1.4.2

   ATTENTION: if you want to build with libssh2 support you have to use latest
   version 0.17 - previous versions will NOT work with 7.17.0 and later!
@@ -320,7 +320,7 @@ Win32
   documentation on how to compile zlib. Define the ZLIB_PATH environment
   variable to the location of zlib.h and zlib.lib, for example:

-     set ZLIB_PATH=c:\zlib-1.2.5
+     set ZLIB_PATH=c:\zlib-1.2.7

   Then run 'nmake vc-zlib' in curl's root directory.

@@ -334,7 +334,7 @@ Win32
   Before running nmake define the OPENSSL_PATH environment variable with
   the root/base directory of OpenSSL, for example:

-     set OPENSSL_PATH=c:\openssl-0.9.8q
+     set OPENSSL_PATH=c:\openssl-0.9.8x

   Then run 'nmake vc-ssl' or 'nmake vc-ssl-dll' in curl's root
   directory.  'nmake vc-ssl' will create a libcurl static and dynamic
@@ -840,7 +840,30 @@ VxWorks

 Android
 =======
-   See the build notes in the Android.mk file.
+   Method using the static makefile:
+      - see the build notes in the Android.mk file.
+
+   Method using a configure cross-compile (tested with Android NDK r7b):
+      - prepare the toolchain of the Android NDK for standalone use; this can
+        be done by invoking the script:
+        ./tools/make-standalone-toolchain.sh
+        which creates a usual cross-compile toolchain. Lets assume that you put
+        this toolchain below /opt then invoke configure with something like:
+        export PATH=/opt/arm-linux-androideabi-4.4.3/bin:$PATH
+        ./configure --host=arm-linux-androideabi [more configure options]
+        make
+      - if you want to compile directly from our GIT repo you might run into
+        this issue with older automake stuff:
+        checking host system type...
+        Invalid configuration `arm-linux-androideabi':
+        system `androideabi' not recognized
+        configure: error: /bin/sh ./config.sub arm-linux-androideabi failed
+        this issue can be fixed with using more recent versions of config.sub
+        and config.guess which can be obtained here:
+        http://git.savannah.gnu.org/gitweb/?p=config.git;a=tree
+        you need to replace your system-own versions which usually can be
+        found in your automake folder:
+        find /usr -name config.sub


 CROSS COMPILE
--- a/docs/INTERNALS
+++ b/docs/INTERNALS
@@ -39,11 +39,11 @@ Portability
 libssh2      0.16
 c-ares       1.6.0
 libidn       0.4.1
- cyassl       1.4.0
+ cyassl       2.0.0
 openldap     2.0
 MIT krb5 lib 1.2.4
 qsossl       V5R2M0
- NSS          3.11.x
+ NSS          3.12.x
 axTLS        1.2.7
 Heimdal      ?

@@ -104,9 +104,9 @@ Windows vs Unix
 Inside the source code, We make an effort to avoid '#ifdef [Your OS]'. All
 conditionals that deal with features *should* instead be in the format
 '#ifdef HAVE_THAT_WEIRD_FUNCTION'. Since Windows can't run configure scripts,
- we maintain two curl_config-win32.h files (one in lib/ and one in src/) that
- are supposed to look exactly as a curl_config.h file would have looked like on
- a Windows machine!
+ we maintain a curl_config-win32.h file in lib directory that is supposed to
+ look exactly as a curl_config.h file would have looked like on a Windows
+ machine!

 Generally speaking: always remember that this will be compiled on dozens of
 operating systems. Don't walk on the edge.
--- a/docs/MAIL-ETIQUETTE
+++ b/docs/MAIL-ETIQUETTE
@@ -13,6 +13,7 @@ MAIL ETIQUETTE
  1.4 Subscription Required
  1.5 Moderation of new posters
  1.6 Handling trolls and spam
+  1.7 How to unsubscribe

 2. Sending mail
  2.1 Reply or New Mail
@@ -110,6 +111,20 @@ MAIL ETIQUETTE

  Don't feed the trolls!

+  1.7 How to unsubscribe
+
+  You unsubscribe the same way you subscribed in the first place. You go to
+  the page for the particular mailing list you're subscribed to and you enter
+  your email address and password and press the unsubscribe button.
+
+  Also, this information is included in the headers of every mail that is sent
+  out to all curl related mailing lists and there's footer in each mail that
+  links to the "admin" page on which you can unsubscribe and change other
+  options.
+
+  You NEVER EVER email the mailing list requesting someone else to get you off
+  the list.
+

 2. Sending mail

--- a/docs/Makefile.am
+++ b/docs/Makefile.am
@@ -22,9 +22,9 @@

 AUTOMAKE_OPTIONS = foreign no-dependencies

-man_MANS = curl.1 curl-config.1
-GENHTMLPAGES = curl.html curl-config.html
-PDFPAGES = curl.pdf curl-config.pdf
+man_MANS = curl.1 curl-config.1 mk-ca-bundle.1
+GENHTMLPAGES = curl.html curl-config.html mk-ca-bundle.html
+PDFPAGES = curl.pdf curl-config.pdf mk-ca-bundle.pdf

 HTMLPAGES = $(GENHTMLPAGES) index.html

--- a/docs/THANKS
+++ b/docs/THANKS
@@ -20,11 +20,13 @@ Albert Choy
 Ale Vesely
 Alejandro Alvarez
 Aleksandar Milivojevic
+Alessandro Ghedini
 Alessandro Vesely
 Alex Bligh
 Alex Fishman
 Alex Neblett
 Alex Suykov
+Alex Vinnik
 Alex aka WindEagle
 Alexander Beedie
 Alexander Kourakos
@@ -53,6 +55,7 @@ Andreas Rieke
 Andreas Schuldei
 Andreas Wurf
 Andrei Benea
+Andrei Cipu
 Andres Garcia
 Andrew Benham
 Andrew Biggs
@@ -74,6 +77,7 @@ Anton Kalmykov
 Arkadiusz Miskiewicz
 Armel Asselin
 Arnaud Ebalard
+Arthur Murray
 Arve Knudsen
 Ates Goral
 Augustus Saunders
@@ -91,6 +95,7 @@ Ben Winslow
 Benbuck Nason
 Benjamin Gerard
 Bernard Leak
+Bernhard Reutner-Fischer
 Bertrand Demiddelaer
 Bill Egert
 Bill Hoffman
@@ -105,6 +110,7 @@ Brad Burdick
 Brad Hards
 Brad King
 Bradford Bruce
+Brandon Wang
 Brendan Jurd
 Brent Beardsley
 Brian Akins
@@ -121,7 +127,9 @@ Camille Moncelier
 Caolan McNamara
 Carsten Lange
 Casey O'Donnell
+Cedric Deltheil
 Chad Monroe
+Chandrakant Bagul
 Charles Kerr
 Chih-Chung Chang
 Chris "Bob Bob"
@@ -133,6 +141,7 @@ Chris Gaukroger
 Chris Maltby
 Chris Mumford
 Chris Smowton
+Christian Grothoff
 Christian Hagele
 Christian Krause
 Christian Kurz
@@ -382,6 +391,8 @@ Jan Kunder
 Jan Van Boghout
 Jared Lundell
 Jari Sundell
+Jason Glasgow
+Jason Liu
 Jason McDonald
 Jason S. Priebe
 Jay Austin
@@ -418,11 +429,13 @@ Jofell Gallardo
 Johan Anderson
 Johan Nilsson
 Johan van Selst
+Johannes Bauer
 John Bradshaw
 John Crow
 John Dennis
 John E. Malmberg
 John Janssen
+John Joseph Bachir
 John Kelly
 John Lask
 John Lightsey
@@ -437,6 +450,7 @@ Jon Sargeant
 Jon Travis
 Jon Turner
 Jonas Forsman
+Jonas Schnelli
 Jonatan Lander
 Jonathan Hseu
 Jongki Suwandi
@@ -445,6 +459,7 @@ Josef Wolf
 Josh Kapell
 Joshua Kwan
 Josue Andrade Gomes
+Juan Barreto
 Juan F. Codagnone
 Juan Ignacio Herv<72>s
 Judson Bishop
@@ -524,6 +539,7 @@ Luke Call
 Luong Dinh Dung
 Maciej Karpiuk
 Maciej W. Rozycki
+Mamoru Tasaka
 Mandy Wu
 Manfred Schwarb
 Manuel Massing
@@ -577,6 +593,7 @@ Mauro Iorio
 Max Katsev
 Maxim Ivanov
 Maxim Perenesenko
+Maxim Prohorov
 Mehmet Bozkurt
 Mekonikum
 Mettgut Jamalla
@@ -584,6 +601,7 @@ Michael Benedict
 Michael Calmer
 Michael Cronenworth
 Michael Curtis
+Michael Day
 Michael Goffioul
 Michael Jahn
 Michael Jerris
@@ -614,6 +632,7 @@ Moonesamy
 Nathan Coulter
 Nathan O'Sullivan
 Nathanael Nerode
+Naveen Chandran
 Naveen Noel
 Neil Dunbar
 Neil Spring
@@ -631,6 +650,7 @@ Nikita Schmidt
 Nikitinskit Dmitriy
 Niklas Angebrand
 Nikolai Kondrashov
+Nikos Mavrogiannopoulos
 Ning Dong
 Nir Soffer
 Nis Jorgensen
@@ -647,6 +667,7 @@ Paolo Piacentini
 Pascal Terjan
 Pasha Kuznetsov
 Pat Ray
+Patrice Guerin
 Patrick Bihan-Faou
 Patrick Monnerat
 Patrick Scott
@@ -694,6 +715,7 @@ Philippe Vaucher
 Pierre
 Pierre Brico
 Pierre Joye
+Pierre Ynard
 Pooyan McSporran
 Pramod Sharma
 Puneet Pawaia
@@ -720,6 +742,7 @@ Renaud Duhaut
 Rene Bernhardt
 Rene Rebe
 Reuven Wachtfogel
+Reza Arbab
 Ricardo Cadime
 Rich Gray
 Rich Rauenzahn
@@ -736,11 +759,13 @@ Rick Richardson
 Rob Crittenden
 Rob Jones
 Rob Stanzel
+Rob Ward
 Robert A. Monat
 Robert D. Young
 Robert Foreman
 Robert Iakobashvili
 Robert Olson
+Robert Schumann
 Robert Weaver
 Robin Cornelius
 Robin Johnson
@@ -809,6 +834,7 @@ Stephen Kick
 Stephen More
 Sterling Hughes
 Steve Green
+Steve H Truong
 Steve Holme
 Steve Lhomme
 Steve Little
@@ -848,6 +874,7 @@ Tobias Rundstr
 Toby Peterson
 Todd A Ouska
 Todd Kulesza
+Todd Ouska
 Todd Vierling
 Tom Benoist
 Tom Donovan
@@ -864,6 +891,7 @@ Tomasz Lacki
 Tommie Gannert
 Tommy Tam
 Ton Voon
+Toni Moreno
 Toon Verwaest
 Tor Arntsen
 Torsten Foertsch
@@ -892,6 +920,7 @@ Vojtech Janota
 Vojtech Minarik
 Vsevolod Novikov
 Walter J. Mack
+Ward Willats
 Wayne Haigh
 Werner Koch
 Wesley Laxton
--- a/docs/TODO
+++ b/docs/TODO
@@ -61,46 +61,57 @@
 8.3 check connection
 8.4 non-gcrypt

- 9. Other protocols
+ 9. SMTP
+ 9.1 Other authentication mechanims
+ 9.2 Specify the preferred authentication mechanism
+ 9.3 Initial response
+ 9.4 Pipelining
+ 
+ 10. POP3
+ 10.1 APOP Authentication
+ 10.2 Other authentication mechanims
+ 10.3 auth= in URLs
+ 
+ 11. Other protocols

- 10. New protocols
- 10.1 RSYNC
+ 12. New protocols
+ 12.1 RSYNC

- 11. Client
- 11.1 sync
- 11.2 glob posts
- 11.3 prevent file overwriting
- 11.4 simultaneous parallel transfers
- 11.5 provide formpost headers
- 11.6 url-specific options
- 11.7 metalink support
- 11.8 warning when setting an option
- 11.9 IPv6 addresses with globbing
+ 13. Client
+ 13.1 sync
+ 13.2 glob posts
+ 13.3 prevent file overwriting
+ 13.4 simultaneous parallel transfers
+ 13.5 provide formpost headers
+ 13.6 url-specific options
+ 13.7 metalink support
+ 13.8 warning when setting an option
+ 13.9 IPv6 addresses with globbing

- 12. Build
- 12.1 roffit
+ 14. Build
+ 14.1 roffit

- 13. Test suite
- 13.1 SSL tunnel
- 13.2 nicer lacking perl message
- 13.3 more protocols supported
- 13.4 more platforms supported
+ 15. Test suite
+ 15.1 SSL tunnel
+ 15.2 nicer lacking perl message
+ 15.3 more protocols supported
+ 15.4 more platforms supported

- 14. Next SONAME bump
- 14.1 http-style HEAD output for ftp
- 14.2 combine error codes
- 14.3 extend CURLOPT_SOCKOPTFUNCTION prototype
+ 16. Next SONAME bump
+ 16.1 http-style HEAD output for ftp
+ 16.2 combine error codes
+ 16.3 extend CURLOPT_SOCKOPTFUNCTION prototype

- 15. Next major release
- 15.1 cleanup return codes
- 15.2 remove obsolete defines
- 15.3 size_t
- 15.4 remove several functions
- 15.5 remove CURLOPT_FAILONERROR
- 15.6 remove CURLOPT_DNS_USE_GLOBAL_CACHE
- 15.7 remove progress meter from libcurl
- 15.8 remove 'curl_httppost' from public
- 15.9 have form functions use CURL handle argument
+ 17. Next major release
+ 17.1 cleanup return codes
+ 17.2 remove obsolete defines
+ 17.3 size_t
+ 17.4 remove several functions
+ 17.5 remove CURLOPT_FAILONERROR
+ 17.6 remove CURLOPT_DNS_USE_GLOBAL_CACHE
+ 17.7 remove progress meter from libcurl
+ 17.8 remove 'curl_httppost' from public
+ 17.9 have form functions use CURL handle argument

 ==============================================================================

@@ -158,7 +169,7 @@
 To make libcurl do blazing fast IPv6 in a dual-stack configuration, this needs
 to be addressed:

-    http://tools.ietf.org/html/draft-ietf-v6ops-happy-eyeballs-07
+    http://tools.ietf.org/html/rfc6555


 2. libcurl - multi interface
@@ -360,18 +371,65 @@ to provide the data to send.
 The correct fix would be to detect which crypto layer that is in use and
 adapt our code to use that instead of blindly assuming gcrypt.

-9. Other protocols
+9. SMTP

-10. New protocols
+9.1 Other authentication mechanims

-10.1 RSYNC
+ Add support for other authentication mechanisms such as digest-md5 and
+ gssapi.

- There's no RFC for protocol nor URI/URL format.  An implementation should
- most probably use an existing rsync library, such as librsync.
+9.2 Specify the preferred authentication mechanism

-11. Client
+ Add the ability to specify the preferred authentication mechanism or a list
+ of mechanims that should be used. Not only that, but the order that is
+ returned by the server during the EHLO response should be honored by curl.
+ 
+9.3 Initial response

-11.1 sync
+ Add the ability for the user to specify whether the initial response is
+ included in the AUTH command. Some email servers, such as Microsoft
+ Exchange, can work with either whilst others need to have the initial
+ response sent separately:
+ 
+ http://curl.haxx.se/mail/lib-2012-03/0114.html
+ 
+9.4 Pipelining
+
+ Add support for pipelining emails.
+ 
+10. POP3
+
+10.1 APOP Authentication
+
+ Add support for the APOP command rather than using plain text authentication
+ (USER and PASS) as this is very week security wise. Note: The APOP command
+ is specified as "APOP <username> <md5 password>", however, it isn't
+ supported by all mail servers.
+ 
+10.2 Other authentication mechanims
+
+ SASL offers support for additional authentication mechanisms via the AUTH
+ command. Detection of an email server's support for SASL authentication
+ can be detected via the CAPA command whilst a list of supported mechanisms
+ can be retrieved with an empty AUTH command.
+ 
+10.3 auth= in URLs
+
+ Being able to specify the preferred authentication mechanim in the URL as
+ per RFC-2384 (http://tools.ietf.org/html/rfc2384).
+ 
+11. Other protocols
+
+12. New protocols
+
+12.1 RSYNC
+
+ There's no RFC for the protocol or an URI/URL format.  An implementation
+ should most probably use an existing rsync library, such as librsync.
+
+13. Client
+
+13.1 sync

 "curl --sync http://example.com/feed[1-100].rss" or
 "curl --sync http://example.net/{index,calendar,history}.html"
@@ -380,12 +438,12 @@ to provide the data to send.
 remote file is newer than the local file. A Last-Modified HTTP date header
 should also be used to set the mod date on the downloaded file.

-11.2 glob posts
+13.2 glob posts

 Globbing support for -d and -F, as in 'curl -d "name=foo[0-9]" URL'.
 This is easily scripted though.

-11.3 prevent file overwriting
+13.3 prevent file overwriting

 Add an option that prevents cURL from overwriting existing local files. When
 used, and there already is an existing file with the target file name
@@ -393,14 +451,14 @@ to provide the data to send.
 existing). So that index.html becomes first index.html.1 and then
 index.html.2 etc.

-11.4 simultaneous parallel transfers
+13.4 simultaneous parallel transfers

 The client could be told to use maximum N simultaneous parallel transfers and
 then just make sure that happens. It should of course not make more than one
 connection to the same remote host. This would require the client to use the
 multi interface. http://curl.haxx.se/bug/feature.cgi?id=1558595

-11.5 provide formpost headers
+13.5 provide formpost headers

 Extending the capabilities of the multipart formposting. How about leaving
 the ';type=foo' syntax as it is and adding an extra tag (headers) which
@@ -414,7 +472,7 @@ to provide the data to send.
 which should overwrite the program reasonable defaults (plain/text,
 8bit...)

-11.6 url-specific options
+13.6 url-specific options

 Provide a way to make options bound to a specific URL among several on the
 command line. Possibly by letting ':' separate options between URLs,
@@ -428,62 +486,62 @@ to provide the data to send.

 The example would do a POST-GET-POST combination on a single command line.

-11.7 metalink support
+13.7 metalink support

 Add metalink support to curl (http://www.metalinker.org/). This is most useful
 with simultaneous parallel transfers (11.6) but not necessary.

-11.8 warning when setting an option
+13.8 warning when setting an option

  Display a warning when libcurl returns an error when setting an option.
  This can be useful to tell when support for a particular feature hasn't been
  compiled into the library.

-11.9 IPv6 addresses with globbing
+13.9 IPv6 addresses with globbing

  Currently the command line client needs to get url globbing disabled (with
  -g) for it to support IPv6 numerical addresses. This is a rather silly flaw
  that should be corrected. It probably involves a smarter detection of the
  '[' and ']' letters.

-12. Build
+14. Build

-12.1 roffit
+14.1 roffit

 Consider extending 'roffit' to produce decent ASCII output, and use that
 instead of (g)nroff when building src/hugehelp.c

-13. Test suite
+15. Test suite

-13.1 SSL tunnel
+15.1 SSL tunnel

 Make our own version of stunnel for simple port forwarding to enable HTTPS
 and FTP-SSL tests without the stunnel dependency, and it could allow us to
 provide test tools built with either OpenSSL or GnuTLS

-13.2 nicer lacking perl message
+15.2 nicer lacking perl message

 If perl wasn't found by the configure script, don't attempt to run the tests
 but explain something nice why it doesn't.

-13.3 more protocols supported
+15.3 more protocols supported

 Extend the test suite to include more protocols. The telnet could just do ftp
 or http operations (for which we have test servers).

-13.4 more platforms supported
+15.4 more platforms supported

 Make the test suite work on more platforms. OpenBSD and Mac OS. Remove
 fork()s and it should become even more portable.

-14. Next SONAME bump
+16. Next SONAME bump

-14.1 http-style HEAD output for ftp
+16.1 http-style HEAD output for ftp

 #undef CURL_FTP_HTTPSTYLE_HEAD in lib/ftp.c to remove the HTTP-style headers
 from being output in NOBODY requests over ftp

-14.2 combine error codes
+16.2 combine error codes

 Combine some of the error codes to remove duplicates.  The original
 numbering should not be changed, and the old identifiers would be
@@ -501,29 +559,29 @@ to provide the data to send.
    CURLE_TFTP_NOTFOUND => CURLE_REMOTE_FILE_NOT_FOUND
    CURLE_TFTP_PERM => CURLE_REMOTE_ACCESS_DENIED

-14.3 extend CURLOPT_SOCKOPTFUNCTION prototype
+16.3 extend CURLOPT_SOCKOPTFUNCTION prototype

 The current prototype only provides 'purpose' that tells what the
 connection/socket is for, but not any protocol or similar. It makes it hard
 for applications to differentiate on TCP vs UDP and even HTTP vs FTP and
 similar.

-15. Next major release
+17. Next major release

-15.1 cleanup return codes
+17.1 cleanup return codes

 curl_easy_cleanup() returns void, but curl_multi_cleanup() returns a
 CURLMcode. These should be changed to be the same.

-15.2 remove obsolete defines
+17.2 remove obsolete defines

 remove obsolete defines from curl/curl.h

-15.3 size_t
+17.3 size_t

 make several functions use size_t instead of int in their APIs

-15.4 remove several functions
+17.4 remove several functions

 remove the following functions from the public API:

@@ -544,18 +602,18 @@ to provide the data to send.

 curl_multi_socket_all

-15.5 remove CURLOPT_FAILONERROR
+17.5 remove CURLOPT_FAILONERROR

 Remove support for CURLOPT_FAILONERROR, it has gotten too kludgy and weird
 internally. Let the app judge success or not for itself.

-15.6 remove CURLOPT_DNS_USE_GLOBAL_CACHE
+17.6 remove CURLOPT_DNS_USE_GLOBAL_CACHE

 Remove support for a global DNS cache. Anything global is silly, and we
 already offer the share interface for the same functionality but done
 "right".

-15.7 remove progress meter from libcurl
+17.7 remove progress meter from libcurl

 The internally provided progress meter output doesn't belong in the library.
 Basically no application wants it (apart from curl) but instead applications
@@ -565,7 +623,7 @@ to provide the data to send.
 variable types passed to it instead of doubles so that big files work
 correctly.

-15.8 remove 'curl_httppost' from public
+17.8 remove 'curl_httppost' from public

 curl_formadd() was made to fill in a public struct, but the fact that the
 struct is public is never really used by application for their own advantage
@@ -574,7 +632,7 @@ to provide the data to send.
 Changing them to return a private handle will benefit the implementation and
 allow us much greater freedoms while still maintining a solid API and ABI.

-15.9 have form functions use CURL handle argument
+17.9 have form functions use CURL handle argument

 curl_formadd() and curl_formget() both currently have no CURL handle
 argument, but both can use a callback that is set in the easy handle, and
--- a/docs/curl-config.1
+++ b/docs/curl-config.1
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2010, Daniel Stenberg, <daniel@haxx.se>, et al.
+.\" * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -93,7 +93,6 @@ What's the installed libcurl version?

 How do I build a single file with a one-line command?

-  $ `curl-config --cc --cflags --libs` -o example example.c
-
+  $ `curl-config --cc --cflags` -o example example.c `curl-config --libs`
 .SH "SEE ALSO"
 .BR curl (1)
--- a/docs/curl.1
+++ b/docs/curl.1
@@ -20,7 +20,7 @@
 .\" *
 .\" **************************************************************************
 .\"
-.TH curl 1 "14 April 2009" "Curl 7.21.6" "Curl Manual"
+.TH curl 1 "16 February 2012" "Curl 7.25.0" "Curl Manual"
 .SH NAME
 curl \- transfer a URL
 .SH SYNOPSIS
@@ -711,7 +711,8 @@ currently effective on operating systems offering the TCP_KEEPIDLE and
 TCP_KEEPINTVL socket options (meaning Linux, recent AIX, HP-UX and more). This
 option has no effect if \fI--no-keepalive\fP is used. (Added in 7.18.0)

-If this option is used multiple times, the last occurrence sets the amount.
+If this option is used multiple times, the last occurrence sets the amount. If
+unspecified, the option defaults to 60 seconds.
 .IP "--key <key>"
 (SSL/SSH) Private key file name. Allows you to provide your private key in this
 separate file.
@@ -761,13 +762,9 @@ was 301, 302, or 303. If the response code was any other 3xx code, curl will
 re-send the following request using the same unmodified method.
 .IP "--libcurl <file>"
 Append this option to any ordinary curl command line, and you will get a
-libcurl-using source code written to the file that does the equivalent
+libcurl-using C source code written to the file that does the equivalent
 of what your command-line operation does!

-NOTE: this does not properly support -F and the sending of multipart
-formposts, so in those cases the output program will be missing necessary
-calls to \fIcurl_formadd(3)\fP, and possibly more.
-
 If this option is used several times, the last given file name will be
 used. (Added in 7.16.1)
 .IP "--limit-rate <speed>"
@@ -805,6 +802,12 @@ useful for preventing your batch jobs from hanging for hours due to slow
 networks or links going down.  See also the \fI--connect-timeout\fP option.

 If this option is used several times, the last one will be used.
+.IP "--mail-auth <address>"
+(SMTP) Specify a single address. This will be used to specify the
+authentication address (identity) of a submitted message that is being relayed
+to another server.
+
+(Added in 7.25.0)
 .IP "--mail-from <address>"
 (SMTP) Specify a single address that the given mail should get sent from.

@@ -1258,6 +1261,12 @@ connection if the server doesn't support SSL/TLS. (Added in 7.20.0)

 This option was formerly known as \fI--ftp-ssl-reqd\fP (added in 7.15.5). That
 option name can still be used but will be removed in a future version.
+.IP "--ssl-allow-beast"
+(SSL) This option tells curl to not work around a security flaw in the SSL3
+and TLS1.0 protocols known as BEAST.  If this option isn't used, the SSL layer
+may use work-arounds known to cause interoperability problems with some older
+SSL implementations. WARNING: this option loosens the SSL security, and by
+using this flag you ask for exactly that.  (Added in 7.25.0)
 .IP "--socks4 <host[:port]>"
 Use the specified SOCKS4 proxy. If the port number is not specified, it is
 assumed at port 1080. (Added in 7.15.2)
@@ -1476,6 +1485,11 @@ The variables available at this point are:
 The URL that was fetched last. This is most meaningful if you've told curl
 to follow location: headers.
 .TP
+.B filename_effective
+The ultimate filename that curl writes out to. This is only meaningful if curl
+is told to write to a file with the --remote-name or --output option. It's most
+useful in combination with the --remote-header-name option. (Added in 7.25.1)
+.TP
 .B http_code
 The numerical response code that was found in the last retrieved HTTP(S) or
 FTP(s) transfer. In 7.18.2 the alias \fBresponse_code\fP was added to show the
@@ -1560,7 +1574,7 @@ means the verification was successful. (Added in 7.19.0)
 .RE

 If this option is used several times, the last one will be used.
-.IP "-x, --proxy <[protocol://][user@password]proxyhost[:port]>"
+.IP "-x, --proxy <[protocol://][user:password@]proxyhost[:port]>"
 Use the specified HTTP proxy. If the port number is not specified, it is
 assumed at port 1080.

@@ -1573,6 +1587,10 @@ converted to HTTP. It means that certain protocol specific operations might
 not be available. This is not the case if you can tunnel through the proxy, as
 one with the \fI-p, --proxytunnel\fP option.

+User and password that might be provided in the proxy string are URL decoded
+by libcurl. This allows you to pass in special characters such as @ by using
+%40 or pass in a colon with %3a.
+
 The proxy host can be specified the exact same way as the proxy environment
 variables, including the protocol prefix (http://) and the embedded user +
 password.
@@ -1619,12 +1637,12 @@ speed-time seconds it gets aborted. speed-time is set with -y and is 30 if
 not set.

 If this option is used several times, the last one will be used.
-.IP "-z, --time-cond <date expression>"
-(HTTP/FTP/FILE) Request a file that has been modified later than the given time
-and date, or one that has been modified before that time. The date expression
-can be all sorts of date strings or if it doesn't match any internal ones, it
-tries to get the time from a given file name instead! See the
-\fIcurl_getdate(3)\fP man pages for date expression details.
+.IP "-z/--time-cond <date expression>|<file>"
+(HTTP/FTP) Request a file that has been modified later than the given time and
+date, or one that has been modified before that time. The <date expression> can
+be all sorts of date strings or if it doesn't match any internal ones, it is
+taken as a filename and tries to get the modification date (mtime) from <file>
+instead. See the \fIcurl_getdate(3)\fP man pages for date expression details.

 Start the date expression with a dash (-) to make it request for a document
 that is older than the given date/time, default is a document that is newer
--- a/docs/examples/Makefile.am
+++ b/docs/examples/Makefile.am
@@ -5,7 +5,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+# Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -23,7 +23,7 @@
 AUTOMAKE_OPTIONS = foreign nostdinc

 EXTRA_DIST = README Makefile.example Makefile.inc Makefile.m32 \
-	Makefile.netware makefile.dj printf_macro.h $(COMPLICATED_EXAMPLES)
+	Makefile.netware makefile.dj $(COMPLICATED_EXAMPLES)

 # Specify our include paths here, and do it relative to $(top_srcdir) and
 # $(top_builddir), to ensure that these paths which belong to the library
@@ -40,12 +40,12 @@ INCLUDES = -I$(top_builddir)/include/curl \

 LIBDIR = $(top_builddir)/lib

-if STATICLIB
-# we need this define when building with a static lib on Windows
-STATICCPPFLAGS = -DCURL_STATICLIB
-endif
+AM_CPPFLAGS = -DCURL_NO_OLDIES

-CPPFLAGS = -DCURL_NO_OLDIES $(STATICCPPFLAGS)
+# Mostly for Windows build targets, when using static libcurl
+if USE_CPPFLAG_CURL_STATICLIB
+AM_CPPFLAGS += -DCURL_STATICLIB
+endif

 # Dependencies
 LDADD = $(LIBDIR)/libcurl.la
--- a/docs/examples/Makefile.m32
+++ b/docs/examples/Makefile.m32
@@ -27,18 +27,18 @@
 ## Example: mingw32-make -f Makefile.m32 CFG=-zlib-ssl-spi-winidn
 ##
 ## Hint: you can also set environment vars to control the build, f.e.:
-## set ZLIB_PATH=c:/zlib-1.2.5
+## set ZLIB_PATH=c:/zlib-1.2.7
 ## set ZLIB=1
 #
 ###########################################################################

 # Edit the path below to point to the base of your Zlib sources.
 ifndef ZLIB_PATH
-ZLIB_PATH = ../../../zlib-1.2.5
+ZLIB_PATH = ../../../zlib-1.2.7
 endif
 # Edit the path below to point to the base of your OpenSSL package.
 ifndef OPENSSL_PATH
-OPENSSL_PATH = ../../../openssl-0.9.8r
+OPENSSL_PATH = ../../../openssl-0.9.8x
 endif
 ifndef OPENSSL_LIBPATH
 OPENSSL_LIBPATH = $(OPENSSL_PATH)/out
@@ -48,7 +48,7 @@ OPENSSL_LIBS = -leay32 -lssl32
 endif
 # Edit the path below to point to the base of your LibSSH2 package.
 ifndef LIBSSH2_PATH
-LIBSSH2_PATH = ../../../libssh2-1.3.0
+LIBSSH2_PATH = ../../../libssh2-1.4.2
 endif
 # Edit the path below to point to the base of your librtmp package.
 ifndef LIBRTMP_PATH
--- a/docs/examples/Makefile.netware
+++ b/docs/examples/Makefile.netware
@@ -14,17 +14,17 @@ endif

 # Edit the path below to point to the base of your Zlib sources.
 ifndef ZLIB_PATH
-ZLIB_PATH = ../../../zlib-1.2.5
+ZLIB_PATH = ../../../zlib-1.2.7
 endif

 # Edit the path below to point to the base of your OpenSSL package.
 ifndef OPENSSL_PATH
-OPENSSL_PATH = ../../../openssl-0.9.8r
+OPENSSL_PATH = ../../../openssl-0.9.8x
 endif

 # Edit the path below to point to the base of your LibSSH2 package.
 ifndef LIBSSH2_PATH
-LIBSSH2_PATH = ../../../libssh2-1.3.0
+LIBSSH2_PATH = ../../../libssh2-1.4.2
 endif

 # Edit the path below to point to the base of your axTLS package.
--- a/docs/examples/anyauthput.c
+++ b/docs/examples/anyauthput.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -42,7 +42,6 @@
 #endif

 #include <curl/curl.h>
-#include "printf_macro.h"

 #if LIBCURL_VERSION_NUM < 0x070c03
 #error "upgrade your libcurl to no less than 7.12.3"
@@ -89,12 +88,16 @@ static curlioerr my_ioctl(CURL *handle, curliocmd cmd, void *userp)
 static size_t read_callback(void *ptr, size_t size, size_t nmemb, void *stream)
 {
  size_t retcode;
+  curl_off_t nread;

  intptr_t fd = (intptr_t)stream;

  retcode = read(fd, ptr, size * nmemb);

-  fprintf(stderr, "*** We read %" _FMT_SIZE_T " bytes from file\n", retcode);
+  nread = (curl_off_t)retcode;
+
+  fprintf(stderr, "*** We read %" CURL_FORMAT_CURL_OFF_T
+          " bytes from file\n", nread);

  return retcode;
 }
--- a/docs/examples/externalsocket.c
+++ b/docs/examples/externalsocket.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -57,7 +57,10 @@ static curl_socket_t opensocket(void *clientp,
                                curlsocktype purpose,
                                struct curl_sockaddr *address)
 {
-  curl_socket_t sockfd = *(curl_socket_t *)clientp;
+  curl_socket_t sockfd;
+  (void)purpose;
+  (void)address;
+  sockfd = *(curl_socket_t *)clientp;
  /* the actual externally set socket is passed in via the OPENSOCKETDATA
     option */
  return sockfd;
@@ -66,6 +69,9 @@ static curl_socket_t opensocket(void *clientp,
 static int sockopt_callback(void *clientp, curl_socket_t curlfd,
                            curlsocktype purpose)
 {
+  (void)clientp;
+  (void)curlfd;
+  (void)purpose;
  /* This return code was added in libcurl 7.21.5 */
  return CURL_SOCKOPT_ALREADY_CONNECTED;
 }
@@ -96,7 +102,7 @@ int main(void)
    curl_easy_setopt(curl, CURLOPT_URL, "http://99.99.99.99:9999");

    /* Create the socket "manually" */
-    if( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0 ) {
+    if( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) == CURL_SOCKET_BAD ) {
      printf("Error creating listening socket.\n");
      return 3;
    }
--- a/docs/examples/ftp-wildcard.c
+++ b/docs/examples/ftp-wildcard.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -33,7 +33,7 @@ static long file_is_comming(struct curl_fileinfo *finfo,
 static long file_is_downloaded(struct callback_data *data);

 static size_t write_it(char *buff, size_t size, size_t nmemb,
-                       struct callback_data *data);
+                       void *cb_data);

 int main(int argc, char **argv)
 {
@@ -135,8 +135,9 @@ static long file_is_downloaded(struct callback_data *data)
 }

 static size_t write_it(char *buff, size_t size, size_t nmemb,
-                       struct callback_data *data)
+                       void *cb_data)
 {
+  struct callback_data *data = cb_data;
  size_t written = 0;
  if(data->output)
    written = fwrite(buff, size, nmemb, data->output);
--- a/docs/examples/ftpupload.c
+++ b/docs/examples/ftpupload.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -32,7 +32,6 @@
 #else
 #include <unistd.h>
 #endif
-#include "printf_macro.h"

 /*
 * This example shows an FTP upload, with a rename of the file just after
@@ -52,12 +51,16 @@
   variable's memory when passed in to it from an app like this. */
 static size_t read_callback(void *ptr, size_t size, size_t nmemb, void *stream)
 {
+  curl_off_t nread;
  /* in real-world cases, this would probably get this data differently
     as this fread() stuff is exactly what the library already would do
     by default internally */
  size_t retcode = fread(ptr, size, nmemb, stream);

-  fprintf(stderr, "*** We read %" _FMT_SIZE_T " bytes from file\n", retcode);
+  nread = (curl_off_t)retcode;
+
+  fprintf(stderr, "*** We read %" CURL_FORMAT_CURL_OFF_T
+          " bytes from file\n", nread);
  return retcode;
 }

--- a/docs/examples/httpput.c
+++ b/docs/examples/httpput.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -25,7 +25,6 @@
 #include <unistd.h>

 #include <curl/curl.h>
-#include "printf_macro.h"

 /*
 * This example shows a HTTP PUT operation. PUTs a file given as a command
@@ -40,13 +39,17 @@
 static size_t read_callback(void *ptr, size_t size, size_t nmemb, void *stream)
 {
  size_t retcode;
+  curl_off_t nread;

  /* in real-world cases, this would probably get this data differently
     as this fread() stuff is exactly what the library already would do
     by default internally */
  retcode = fread(ptr, size, nmemb, stream);

-  fprintf(stderr, "*** We read %" _FMT_SIZE_T " bytes from file\n", retcode);
+  nread = (curl_off_t)retcode;
+
+  fprintf(stderr, "*** We read %" CURL_FORMAT_CURL_OFF_T
+          " bytes from file\n", nread);

  return retcode;
 }
--- a/docs/examples/imap.c
+++ b/docs/examples/imap.c
@@ -25,7 +25,7 @@
 int main(void)
 {
  CURL *curl;
-  CURLcode res;
+  CURLcode res = CURLE_OK;

  curl = curl_easy_init();
  if(curl) {
--- a/docs/examples/post-callback.c
+++ b/docs/examples/post-callback.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -30,7 +30,7 @@ const char data[]="this is what we post to the silly web server";

 struct WriteThis {
  const char *readptr;
-  int sizeleft;
+  long sizeleft;
 };

 static size_t read_callback(void *ptr, size_t size, size_t nmemb, void *userp)
@@ -96,7 +96,7 @@ int main(void)
 #else
    /* Set the expected POST size. If you want to POST large amounts of data,
       consider CURLOPT_POSTFIELDSIZE_LARGE */
-    curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (curl_off_t)pooh.sizeleft);
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, pooh.sizeleft);
 #endif

 #ifdef DISABLE_EXPECT
--- a/docs/examples/printf_macro.h
+++ b/docs/examples/printf_macro.h
@@ -1,45 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at http://curl.haxx.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- ***************************************************************************/
-/* Simple hack trying to get a valid printf format string for size_t.
- * If that fails for your platform you can define your own _FMT_SIZE_T,
- * f.e.: -D_FMT_SIZE_T="zd"
- */
-#ifndef _PRINTF_MACRO_H
-#define _PRINTF_MACRO_H
-
-#ifndef _FMT_SIZE_T
-#ifdef WIN32
-#define _FMT_SIZE_T "Id"
-#else
-/*
-"zd" is a GNU extension to POSIX; so we dont use it for size_t but hack around
-#define _FMT_SIZE_T "zd"
-*/
-#ifdef __x86_64__
-#define _FMT_SIZE_T "lu"
-#else
-#define _FMT_SIZE_T "u"
-#endif /* __x86_64__ */
-#endif /* WIN32 */
-#endif /* !_FMT_SIZE_T */
-
-#endif /* !_PRINTF_MACRO_H */
--- a/docs/examples/sendrecv.c
+++ b/docs/examples/sendrecv.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -24,7 +24,6 @@
 #include <stdio.h>
 #include <string.h>
 #include <curl/curl.h>
-#include "printf_macro.h"

 /* Auxiliary function that waits on the socket. */
 static int wait_on_socket(curl_socket_t sockfd, int for_recv, long timeout_ms)
@@ -65,6 +64,7 @@ int main(void)
  curl_socket_t sockfd; /* socket */
  long sockextr;
  size_t iolen;
+  curl_off_t nread;

  curl = curl_easy_init();
  if(curl) {
@@ -123,7 +123,9 @@ int main(void)
      if(CURLE_OK != res)
        break;

-      printf("Received %" _FMT_SIZE_T " bytes.\n", iolen);
+      nread = (curl_off_t)iolen;
+
+      printf("Received %" CURL_FORMAT_CURL_OFF_T " bytes.\n", nread);
    }

    /* always cleanup */
--- a/docs/libcurl/curl_easy_getinfo.3
+++ b/docs/libcurl/curl_easy_getinfo.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+.\" * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -44,11 +44,13 @@ The following information can be extracted:
 .IP CURLINFO_EFFECTIVE_URL
 Pass a pointer to a char pointer to receive the last used effective URL.
 .IP CURLINFO_RESPONSE_CODE
-Pass a pointer to a long to receive the last received HTTP or FTP code. This
-option was known as CURLINFO_HTTP_CODE in libcurl 7.10.7 and earlier. This
-will be zero if no server response code has been received. Note that a proxy's
-CONNECT response should be read with \fICURLINFO_HTTP_CONNECTCODE\fP and not
-this.
+Pass a pointer to a long to receive the last received HTTP, FTP or SMTP
+response code. This option was previously known as CURLINFO_HTTP_CODE in
+libcurl 7.10.7 and earlier. The value will be zero if no server response code
+has been received. Note that a proxy's CONNECT response should be read with
+\fICURLINFO_HTTP_CONNECTCODE\fP and not this.
+
+Support for SMTP responses added in 7.25.0.
 .IP CURLINFO_HTTP_CONNECTCODE
 Pass a pointer to a long to receive the last received proxy response code to a
 CONNECT request.
--- a/docs/libcurl/curl_easy_setopt.3
+++ b/docs/libcurl/curl_easy_setopt.3
@@ -266,7 +266,7 @@ If you forward the input arguments directly to "fseek" or "lseek", note that
 the data type for \fIoffset\fP is not the same as defined for curl_off_t on
 many systems! (Option added in 7.18.0)
 .IP CURLOPT_SEEKDATA
-Data pointer to pass to the file read function. If you use the
+Data pointer to pass to the file seek function. If you use the
 \fICURLOPT_SEEKFUNCTION\fP option, this is the pointer you'll get as input. If
 you don't specify a seek callback, NULL is passed. (Option added in 7.18.0)
 .IP CURLOPT_SOCKOPTFUNCTION
@@ -281,7 +281,7 @@ socket descriptor so additional setsockopt() calls can be done at the user's
 discretion.  Return 0 (zero) from the callback on success. Return 1 from the
 callback function to signal an unrecoverable error to the library and it will
 close the socket and return \fICURLE_COULDNT_CONNECT\fP.  (Option added in
-7.15.6.)
+7.16.0)

 Added in 7.21.5, the callback function may return
 \fICURL_SOCKOPT_ALREADY_CONNECTED\fP, which tells libcurl that the socket is
@@ -289,7 +289,7 @@ in fact already connected and then libcurl will not attempt to connect it.
 .IP CURLOPT_SOCKOPTDATA
 Pass a pointer that will be untouched by libcurl and passed as the first
 argument in the sockopt callback set with \fICURLOPT_SOCKOPTFUNCTION\fP.
-(Option added in 7.15.6.)
+(Option added in 7.16.0)
 .IP CURLOPT_OPENSOCKETFUNCTION
 Function pointer that should match the \fIcurl_opensocket_callback\fP
 prototype found in \fI<curl/curl.h>\fP. This function gets called by libcurl
@@ -322,7 +322,7 @@ to the \fICURLOPT_OPENSOCKETFUNCTION\fP option. Return 0 to signal success and
 1 if there was an error.  (Option added in 7.21.7)
 .IP CURLOPT_CLOSESOCKETDATA
 Pass a pointer that will be untouched by libcurl and passed as the first
-argument in the opensocket callback set with
+argument in the closesocket callback set with
 \fICURLOPT_CLOSESOCKETFUNCTION\fP.  (Option added in 7.21.7)
 .IP CURLOPT_PROGRESSFUNCTION
 Function pointer that should match the \fIcurl_progress_callback\fP prototype
@@ -357,7 +357,7 @@ of bytes actually taken care of. If that amount differs from the amount passed
 to your function, it'll signal an error to the library. This will abort the
 transfer and return \fICURL_WRITE_ERROR\fP.

-A complete header that is passed to this function can be up to
+A complete HTTP header that is passed to this function can be up to
 \fICURL_MAX_HTTP_HEADER\fP (100K) bytes.

 If this option is not set, or if it is set to NULL, but
@@ -380,6 +380,9 @@ to detect it being a trailer and not an ordinary header: 1) it comes after the
 response-body. 2) it comes after the final header line (CR LF) 3) a Trailer:
 header among the regular response-headers mention what header(s) to expect in
 the trailer.
+
+For non-HTTP protocols like FTP, POP3, IMAP and SMTP this function will get
+called with the server responses to the commands that libcurl sends.
 .IP CURLOPT_WRITEHEADER
 (This option is also known as \fBCURLOPT_HEADERDATA\fP) Pass a pointer to be
 used to write the header part of the received data to. If you don't use
@@ -419,7 +422,7 @@ built against another SSL library, this functionality is absent.

 Function pointer that should match the following prototype: \fBCURLcode
 sslctxfun(CURL *curl, void *sslctx, void *parm);\fP This function gets called
-by libcurl just before the initialization of an SSL connection after having
+by libcurl just before the initialization of a SSL connection after having
 processed all other SSL related options to give a last chance to an
 application to modify the behaviour of openssl's ssl initialization. The
 \fIsslctx\fP parameter is actually a pointer to an openssl \fISSL_CTX\fP. If
@@ -434,7 +437,7 @@ the SSL negotiation. The SSL_CTX pointer will be a new one every time.
 To use this properly, a non-trivial amount of knowledge of the openssl
 libraries is necessary. For example, using this function allows you to use
 openssl callbacks to add additional validation code for certificates, and even
-to change the actual URI of an HTTPS request (example used in the lib509 test
+to change the actual URI of a HTTPS request (example used in the lib509 test
 case).  See also the example section for a replacement of the key, certificate
 and trust file settings.
 .IP CURLOPT_SSL_CTX_DATA
@@ -711,7 +714,7 @@ pop3://user:password@mail.domain.com/1 - This retrieves the first message

 .B SCP

-The path part of an SCP request specifies the file to retrieve and from what
+The path part of a SCP request specifies the file to retrieve and from what
 directory. The file part may not be omitted. The file is taken as an absolute
 path from the root directory on the server. To specify a path relative to
 the user's home directory on the server, prepend ~/ to the path portion.
@@ -725,7 +728,7 @@ user's home directory on the server

 .B SFTP

-The path part of an SFTP request specifies the file to retrieve and from what
+The path part of a SFTP request specifies the file to retrieve and from what
 directory. If the file part is omitted then libcurl downloads the directory
 listing for the directory specified.  If the path ends in a / then a directory
 listing is returned instead of a file.  If the path is omitted entirely then
@@ -778,7 +781,7 @@ proxy's port number may optionally be specified with the separate option. If
 not specified, libcurl will default to using port 1080 for proxies.
 \fICURLOPT_PROXYPORT\fP.

-When you tell the library to use an HTTP proxy, libcurl will transparently
+When you tell the library to use a HTTP proxy, libcurl will transparently
 convert operations to HTTP even if you specify an FTP URL etc. This may have
 an impact on what other features of the library you can use, such as
 \fICURLOPT_QUOTE\fP and similar FTP specifics that don't work unless you
@@ -808,7 +811,7 @@ specified in the proxy string \fICURLOPT_PROXY\fP.
 .IP CURLOPT_PROXYTYPE
 Pass a long with this option to set type of the proxy. Available options for
 this are \fICURLPROXY_HTTP\fP, \fICURLPROXY_HTTP_1_0\fP (added in 7.19.4),
-\fICURLPROXY_SOCKS4\fP (added in 7.15.2), \fICURLPROXY_SOCKS5\fP,
+\fICURLPROXY_SOCKS4\fP (added in 7.10), \fICURLPROXY_SOCKS5\fP,
 \fICURLPROXY_SOCKS4A\fP (added in 7.18.0) and \fICURLPROXY_SOCKS5_HOSTNAME\fP
 (added in 7.18.0). The HTTP type is default. (Added in 7.10)

@@ -817,7 +820,7 @@ affect how libcurl speaks to a proxy when CONNECT is used. The HTTP version
 used for "regular" HTTP requests is instead controlled with
 \fICURLOPT_HTTP_VERSION\fP.
 .IP CURLOPT_NOPROXY
-Pass a pointer to a zero terminated string. The should be a comma separated
+Pass a pointer to a zero terminated string. This should be a comma separated
 list of hosts which do not use a proxy, if one is specified.  The only
 wildcard is a single * character, which matches all hosts, and effectively
 disables the proxy. Each name in this list is matched as either a domain which
@@ -915,6 +918,20 @@ overdone.
 .IP CURLOPT_ADDRESS_SCOPE
 Pass a long specifying the scope_id value to use when connecting to IPv6
 link-local or site-local addresses. (Added in 7.19.0)
+.IP CURLOPT_TCP_KEEPALIVE
+Pass a long. If set to 1, TCP keepalive probes will be sent. The delay and
+frequency of these probes can be controlled by the \fICURLOPT_TCP_KEEPIDLE\fP
+and \fICURLOPT_TCP_KEEPINTVL\fP options, provided the operating system supports
+them. Set to 0 (default behavior) to disable keepalive probes (Added in
+7.25.0).
+.IP CURLOPT_TCP_KEEPIDLE
+Pass a long. Sets the delay, in seconds, that the operating system will wait
+while the connection is idle before sending keepalive probes. Not all operating
+systems support this option. (Added in 7.25.0)
+.IP CURLOPT_TCP_KEEPINTVL
+Pass a long. Sets the interval, in seconds, that the operating system will wait
+between sending keepalive probes. Not all operating systems support this
+option. (Added in 7.25.0)
 .SH NAMES and PASSWORDS OPTIONS (Authentication)
 .IP CURLOPT_NETRC
 This parameter controls the preference of libcurl between using user names and
@@ -1047,8 +1064,8 @@ HTTP NTLM authentication. A proprietary protocol invented and used by
 Microsoft. It uses a challenge-response and hash concept similar to Digest, to
 prevent the password from being eavesdropped.

-You need to build libcurl with OpenSSL support for this option to work, or
-build libcurl on Windows.
+You need to build libcurl with either OpenSSL, GnuTLS or NSS support for this
+option to work, or build libcurl on Windows.
 .IP CURLAUTH_NTLM_WB
 NTLM delegating to winbind helper. Authentication is performed by a separate
 binary application that is executed when needed. The name of the application
@@ -1115,7 +1132,7 @@ Pass a parameter set to 1 to enable this. When enabled, libcurl will
 automatically set the Referer: field in requests where it follows a Location:
 redirect.
 .IP CURLOPT_ACCEPT_ENCODING
-Sets the contents of the Accept-Encoding: header sent in an HTTP request, and
+Sets the contents of the Accept-Encoding: header sent in a HTTP request, and
 enables decoding of a response when a Content-Encoding: header is received.
 Three encodings are supported: \fIidentity\fP, which does nothing,
 \fIdeflate\fP which requests the server to compress its response using the
@@ -1143,7 +1160,7 @@ by both HTTP clients and HTTP servers.
 (Added in 7.21.6)
 .IP CURLOPT_FOLLOWLOCATION
 A parameter set to 1 tells the library to follow any Location: header that the
-server sends as part of an HTTP header.
+server sends as part of a HTTP header.

 This means that the library will re-send the same request on the new location
 and follow new Location: headers all the way until no more such headers are
@@ -1166,12 +1183,13 @@ Setting the limit to 0 will make libcurl refuse any redirect. Set it to -1 for
 an infinite number of redirects (which is the default)
 .IP CURLOPT_POSTREDIR
 Pass a bitmask to control how libcurl acts on redirects after POSTs that get a
-301 or 302 response back.  A parameter with bit 0 set (value
+301, 302 or 303 response back.  A parameter with bit 0 set (value
 \fBCURL_REDIR_POST_301\fP) tells the library to respect RFC 2616/10.3.2 and
 not convert POST requests into GET requests when following a 301
 redirection. Setting bit 1 (value CURL_REDIR_POST_302) makes libcurl maintain
-the request method after a 302 redirect. CURL_REDIR_POST_ALL is a convenience
-define that sets both bits.
+the request method after a 302 redirect. Setting bit 2 (value
+\fBCURL_REDIR_POST_303) makes libcurl maintain the request method after a 302
+redirect. CURL_REDIR_POST_ALL is a convenience define that sets both bits.

 The non-RFC behaviour is ubiquitous in web browsers, so the library does the
 conversion by default to maintain consistency. However, a server may require a
@@ -1223,7 +1241,7 @@ If you issue a POST request and then want to make a HEAD or GET using the same
 re-used handle, you must explicitly set the new request type using
 \fICURLOPT_NOBODY\fP or \fICURLOPT_HTTPGET\fP or similar.
 .IP CURLOPT_POSTFIELDS
-Pass a void * as parameter, which should be the full data to post in an HTTP
+Pass a void * as parameter, which should be the full data to post in a HTTP
 POST operation. You must make sure that the data is formatted the way you want
 the server to receive it. libcurl will not convert or encode it for you. Most
 web servers will assume this data to be url-encoded.
@@ -1258,7 +1276,7 @@ Pass a curl_off_t as parameter. Use this to set the size of the
 data to figure out the size. This is the large file version of the
 \fICURLOPT_POSTFIELDSIZE\fP option. (Added in 7.11.1)
 .IP CURLOPT_COPYPOSTFIELDS
-Pass a char * as parameter, which should be the full data to post in an HTTP
+Pass a char * as parameter, which should be the full data to post in a HTTP
 POST operation. It behaves as the \fICURLOPT_POSTFIELDS\fP option, but the
 original data are copied by the library, allowing the application to overwrite
 the original data after setting this option.
@@ -1430,25 +1448,48 @@ transfer decoding will be disabled, if set to 1 it is enabled
 option is set to zero. (added in 7.16.2)
 .SH SMTP OPTIONS
 .IP CURLOPT_MAIL_FROM
-Pass a pointer to a zero terminated string as parameter. It will be used to
-specify the sender address in a mail when sending an SMTP mail with libcurl.
+Pass a pointer to a zero terminated string as parameter. This should be used
+to specify the sender's email address when sending SMTP mail with libcurl.

-An originator email address in SMTP lingo is specified within angle brackets
-(<>) which libcurl will not add for you before version 7.21.4. Failing to
-provide such brackets may cause the server to reject your mail.
+An originator email address should be specified with angled brackets (<>)
+around it, which if not specified, will be added by libcurl from version
+7.21.4 onwards. Failing to provide such brackets may cause the server to
+reject the email.
+
+If this parameter is not specified then an empty address will be sent to the
+mail server which may or may not cause the email to be rejected.

 (Added in 7.20.0)
 .IP CURLOPT_MAIL_RCPT
 Pass a pointer to a linked list of recipients to pass to the server in your
-SMTP mail request.  The linked list should be a fully valid list of \fBstruct
+SMTP mail request. The linked list should be a fully valid list of \fBstruct
 curl_slist\fP structs properly filled in. Use \fIcurl_slist_append(3)\fP to
 create the list and \fIcurl_slist_free_all(3)\fP to clean up an entire list.

-Each recipient in SMTP lingo is specified with angle brackets (<>), but should
-you not use an angle bracket as first letter libcurl will assume you provide a
-single email address only and enclose that with angle brackets for you.
+Each recipient should be specified within a pair of angled brackets (<>),
+however, should you not use an angled bracket as the first character libcurl
+will assume you provided a single email address and enclose that address
+within brackets for you.

 (Added in 7.20.0)
+.IP CURLOPT_MAIL_AUTH
+Pass a pointer to a zero terminated string as parameter. This will be used
+to specify the authentication address (identity) of a submitted message that
+is being relayed to another server.
+
+This optional parameter allows co-operating agents in a trusted environment to
+communicate the authentication of individual messages and should only be used
+by the application program, using libcurl, if the application is itself a
+mail server acting in such an environment. If the application is operating as
+such and the AUTH address is not known or is invalid, then an empty string
+should be used for this parameter.
+
+Unlike CURLOPT_MAIL_FROM and CURLOPT_MAIL_RCPT, the address should not be
+specified within a pair of angled brackets (<>). However, if an empty string
+is used then a pair of brackets will be sent by libcurl as required by
+RFC-2554.
+
+(Added in 7.24.0)
 .SH TFTP OPTIONS
 .IP CURLOPT_TFTP_BLKSIZE
 Specify block size to use for TFTP data transmission. Valid range as per RFC
@@ -1515,7 +1556,7 @@ Pass a pointer to a linked list of FTP commands to pass to the server after
 the transfer type is set. The linked list should be a fully valid list of
 struct curl_slist structs properly filled in as described for
 \fICURLOPT_QUOTE\fP. Disable this operation again by setting a NULL to this
-option. Before version 7.15.6, if you also set \fICURLOPT_NOBODY\fP to 1, this
+option. Before version 7.16.0, if you also set \fICURLOPT_NOBODY\fP to 1, this
 option didn't work.
 .IP CURLOPT_DIRLISTONLY
 A parameter set to 1 tells the library to just list the names of files in a
@@ -1670,7 +1711,7 @@ needed for this method)\fP  (Added in 7.20.0)
 When sent by a client, this method changes the description of the session. For
 example, if a client is using the server to record a meeting, the client can
 use Announce to inform the server of all the meta-information about the
-session.  ANNOUNCE acts like an HTTP PUT or POST just like
+session.  ANNOUNCE acts like a HTTP PUT or POST just like
 \fICURL_RTSPREQ_SET_PARAMETER\fP (Added in 7.20.0)
 .IP CURL_RTSPREQ_SETUP
 Setup is used to initialize the transport layer for the session. The
@@ -1693,7 +1734,7 @@ different connections.  (Added in 7.20.0)
 .IP CURL_RTSPREQ_GET_PARAMETER
 Retrieve a parameter from the server. By default, libcurl will automatically
 include a \fIContent-Type: text/parameters\fP header on all non-empty requests
-unless a custom one is set. GET_PARAMETER acts just like an HTTP PUT or POST
+unless a custom one is set. GET_PARAMETER acts just like a HTTP PUT or POST
 (see \fICURL_RTSPREQ_SET_PARAMETER\fP).
 Applications wishing to send a heartbeat message (e.g. in the presence of a
 server-specified timeout) should send use an empty GET_PARAMETER request.
@@ -1701,9 +1742,9 @@ server-specified timeout) should send use an empty GET_PARAMETER request.
 .IP CURL_RTSPREQ_SET_PARAMETER
 Set a parameter on the server. By default, libcurl will automatically include
 a \fIContent-Type: text/parameters\fP header unless a custom one is set. The
-interaction with SET_PARAMTER is much like an HTTP PUT or POST. An application
-may either use \fICURLOPT_UPLOAD\fP with \fICURLOPT_READDATA\fP like an HTTP
-PUT, or it may use \fICURLOPT_POSTFIELDS\fP like an HTTP POST. No chunked
+interaction with SET_PARAMTER is much like a HTTP PUT or POST. An application
+may either use \fICURLOPT_UPLOAD\fP with \fICURLOPT_READDATA\fP like a HTTP
+PUT, or it may use \fICURLOPT_POSTFIELDS\fP like a HTTP POST. No chunked
 transfers are allowed, so the application must set the
 \fICURLOPT_INFILESIZE\fP in the former and \fICURLOPT_POSTFIELDSIZE\fP in the
 latter. Also, there is no use of multi-part POSTs within RTSP. (Added in
@@ -1765,7 +1806,7 @@ over FTP. This is a known limitation/flaw that nobody has rectified. libcurl
 simply sets the mode to ASCII and performs a standard transfer.
 .IP CURLOPT_PROXY_TRANSFER_MODE
 Pass a long. If the value is set to 1 (one), it tells libcurl to set the
-transfer mode (binary or ASCII) for FTP transfers done via an HTTP proxy, by
+transfer mode (binary or ASCII) for FTP transfers done via a HTTP proxy, by
 appending ;type=a or ;type=i to the URL. Without this setting, or it being set
 to 0 (zero, the default), \fICURLOPT_TRANSFERTEXT\fP has no effect when doing
 FTP via a proxy. Beware that not all proxies support this feature.  (Added in
@@ -1802,16 +1843,20 @@ source file to the remote target file.
 Pass a curl_off_t as parameter. It contains the offset in number of bytes that
 you want the transfer to start from. (Added in 7.11.0)
 .IP CURLOPT_CUSTOMREQUEST
-Pass a pointer to a zero terminated string as parameter. It will be used
-instead of GET or HEAD when doing an HTTP request, or instead of LIST or NLST
-when doing a FTP directory listing. This is useful for doing DELETE or other
-more or less obscure HTTP requests. Don't do this at will, make sure your
-server supports the command first.
+Pass a pointer to a zero terminated string as parameter. It can be used to
+specify the request instead of GET or HEAD when performing HTTP based
+requests, instead of LIST and NLST when performing FTP directory listings and
+instead of LIST and RETR when issuing POP3 based commands. This is
+particularly useful, for example, for performing a HTTP DELETE request or a
+POP3 DELE command.

+Please don't perform this at will, on HTTP based requests, by making sure
+your server supports the command you are sending first.
+ 
 When you change the request method by setting \fBCURLOPT_CUSTOMREQUEST\fP to
-something, you don't actually change how libcurl behaves or acts in regards to
-the particular request method, it will only change the actual string sent in
-the request.
+something, you don't actually change how libcurl behaves or acts in regards
+to the particular request method, it will only change the actual string sent
+in the request.

 For example: if you tell libcurl to do a HEAD request, but then change the
 request to a "GET" with \fBCURLOPT_CUSTOMREQUEST\fP you'll still see libcurl
@@ -1823,12 +1868,14 @@ POST, use \fICURLOPT_POST\fP or \fICURLOPT_POSTFIELDS\fP and so on.
 Restore to the internal default by setting this to NULL.

 Many people have wrongly used this option to replace the entire request with
-their own, including multiple headers and POST contents. While that might work
-in many cases, it will cause libcurl to send invalid requests and it could
-possibly confuse the remote server badly. Use \fICURLOPT_POST\fP and
+their own, including multiple headers and POST contents. While that might
+work in many cases, it will cause libcurl to send invalid requests and it
+could possibly confuse the remote server badly. Use \fICURLOPT_POST\fP and
 \fICURLOPT_POSTFIELDS\fP to set POST data. Use \fICURLOPT_HTTPHEADER\fP to
 replace or extend the set of headers sent by libcurl. Use
 \fICURLOPT_HTTP_VERSION\fP to change HTTP version.
+
+(Support for POP3 added in 7.26.0)
 .IP CURLOPT_FILETIME
 Pass a long. If it is 1, libcurl will attempt to get the modification date of
 the remote document in this operation. This requires that the remote server
@@ -1837,11 +1884,11 @@ sends the time or replies to a time querying command. The
 can be used after a transfer to extract the received time (if any).
 .IP CURLOPT_NOBODY
 A parameter set to 1 tells the library to not include the body-part in the
-output. This is only relevant for protocols that have separate header and body
-parts. On HTTP(S) servers, this will make libcurl do a HEAD request.
+output. This is only relevant for protocols that have separate header and
+body parts. On HTTP(S) servers, this will make libcurl do a HEAD request.

-To change request to GET, you should use \fICURLOPT_HTTPGET\fP. Change request
-to POST with \fICURLOPT_POST\fP etc.
+To change request to GET, you should use \fICURLOPT_HTTPGET\fP. Change
+request to POST with \fICURLOPT_POST\fP etc.
 .IP CURLOPT_INFILESIZE
 When uploading a file to a remote site, this option should be used to tell
 libcurl what the expected size of the infile is. This value should be passed
@@ -1921,6 +1968,8 @@ SIGALRM to enable time-outing system calls.

 In unix-like systems, this might cause signals to be used unless
 \fICURLOPT_NOSIGNAL\fP is set.
+
+Default timeout is 0 (zero) which means it never times out.
 .IP CURLOPT_TIMEOUT_MS
 Like \fICURLOPT_TIMEOUT\fP but takes number of milliseconds instead. If
 libcurl is built to use the standard system name resolver, that portion
@@ -2146,7 +2195,7 @@ Pass a long as parameter. By default, curl assumes a value of 1.
 This option determines whether curl verifies the authenticity of the peer's
 certificate. A value of 1 means curl verifies; 0 (zero) means it doesn't.

-When negotiating an SSL connection, the server sends a certificate indicating
+When negotiating a SSL connection, the server sends a certificate indicating
 its identity.  Curl verifies whether the certificate is authentic, i.e. that
 you can trust that the server is who the certificate says it is.  This trust
 is based on a chain of digital signatures, rooted in certification authority
@@ -2295,6 +2344,16 @@ this to 1 to enable it. By default all transfers are done using the
 cache. While nothing ever should get hurt by attempting to reuse SSL
 session-IDs, there seem to be broken SSL implementations in the wild that may
 require you to disable this in order for you to succeed. (Added in 7.16.0)
+.IP CURLOPT_SSL_OPTIONS
+Pass a long with a bitmask to tell libcurl about specific SSL behaviors.
+
+CURLSSLOPT_ALLOW_BEAST is the only supported bit and by setting this the user
+will tell libcurl to not attempt to use any work-arounds for a security flaw
+in the SSL3 and TLS1.0 protocols.  If this option isn't used or this bit is
+set to 0, the SSL layer libcurl uses may use a work-around for this flaw
+although it might cause interoperability problems with some (older) SSL
+implementations. WARNING: avoiding this work-around loosens the security, and
+by setting this option to 1 you ask for exactly that. (Added in 7.25.0)
 .IP CURLOPT_KRBLEVEL
 Pass a char * as parameter. Set the kerberos security level for FTP; this also
 enables kerberos awareness.  This is a string, \&'clear', \&'safe',
@@ -2315,8 +2374,8 @@ GSS_C_DELEG_POLICY_FLAG was available at compile-time.
 .IP CURLOPT_SSH_AUTH_TYPES
 Pass a long set to a bitmask consisting of one or more of
 CURLSSH_AUTH_PUBLICKEY, CURLSSH_AUTH_PASSWORD, CURLSSH_AUTH_HOST,
-CURLSSH_AUTH_KEYBOARD. Set CURLSSH_AUTH_ANY to let libcurl pick one.
-(Added in 7.16.1)
+CURLSSH_AUTH_KEYBOARD. Set CURLSSH_AUTH_ANY to let libcurl pick one. Currently
+CURLSSH_AUTH_HOST has no effect. (Added in 7.16.1)
 .IP CURLOPT_SSH_HOST_PUBLIC_KEY_MD5
 Pass a char * pointing to a string containing 32 hexadecimal digits. The
 string should be the 128 bit MD5 checksum of the remote host's public key, and
@@ -2327,6 +2386,9 @@ Pass a char * pointing to a file name for your public key. If not used,
 libcurl defaults to \fB$HOME/.ssh/id_dsa.pub\fP if the HOME environment
 variable is set, and just "id_dsa.pub" in the current directory if HOME is not
 set.  (Added in 7.16.1)
+If an empty string is passed, libcurl will pass no public key to libssh2
+which then tries to compute it from the private key, this is known to work
+when libssh2 1.4.0+ is linked against OpenSSL. (Added in 7.26.0)
 .IP CURLOPT_SSH_PRIVATE_KEYFILE
 Pass a char * pointing to a file name for your private key. If not used,
 libcurl defaults to \fB$HOME/.ssh/id_dsa\fP if the HOME environment variable
--- a/docs/libcurl/libcurl-errors.3
+++ b/docs/libcurl/libcurl-errors.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+.\" * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -81,11 +81,6 @@ either a PASV or a EPSV command. The server is flawed.
 .IP "CURLE_FTP_WEIRD_227_FORMAT (14)"
 FTP servers return a 227-line as a response to a PASV command. If libcurl
 fails to parse that line, this return code is passed back.
-.IP "CURLE_FTP_PRET_FAILED (84)"
-The FTP server does not understand the PRET command at all or does not support
-the given argument. Be careful when using \fICURLOPT_CUSTOMREQUEST\fP, a
-custom LIST command will be sent with PRET CMD before PASV as well. (Added in
-7.20.0)
 .IP "CURLE_FTP_CANT_GET_HOST (15)"
 An internal failure to lookup the host used for the new connection.
 .IP "CURLE_FTP_COULDNT_SET_TYPE (17)"
@@ -233,7 +228,10 @@ Failed to load CRL file (Added in 7.19.0)
 .IP "CURLE_SSL_ISSUER_ERROR (83)"
 Issuer check failed (Added in 7.19.0)
 .IP "CURLE_FTP_PRET_FAILED (84)"
-PRET command failed
+The FTP server does not understand the PRET command at all or does not support
+the given argument. Be careful when using \fICURLOPT_CUSTOMREQUEST\fP, a
+custom LIST command will be sent with PRET CMD before PASV as well. (Added in
+7.20.0)
 .IP "CURLE_RTSP_CSEQ_ERROR (85)"
 Mismatch of RTSP CSeq numbers.
 .IP "CURLE_RTSP_SESSION_ERROR (86)"
--- a/docs/libcurl/symbols-in-versions
+++ b/docs/libcurl/symbols-in-versions
@@ -384,6 +384,7 @@ CURLOPT_LOCALPORT               7.15.2
 CURLOPT_LOCALPORTRANGE          7.15.2
 CURLOPT_LOW_SPEED_LIMIT         7.1
 CURLOPT_LOW_SPEED_TIME          7.1
+CURLOPT_MAIL_AUTH               7.25.0
 CURLOPT_MAIL_FROM               7.20.0
 CURLOPT_MAIL_RCPT               7.20.0
 CURLOPT_MAXCONNECTS             7.7
@@ -407,7 +408,7 @@ CURLOPT_OPENSOCKETFUNCTION      7.17.1
 CURLOPT_PASSWDDATA              7.4.2         7.11.1      7.15.5
 CURLOPT_PASSWDFUNCTION          7.4.2         7.11.1      7.15.5
 CURLOPT_PASSWORD                7.19.1
-CURLOPT_PASV_HOST               7.12.1        7.15.6      7.15.5
+CURLOPT_PASV_HOST               7.12.1        7.16.0      7.15.5
 CURLOPT_PORT                    7.1
 CURLOPT_POST                    7.1
 CURLOPT_POST301                 7.17.1        7.19.1
@@ -482,10 +483,14 @@ CURLOPT_SSLVERSION              7.1
 CURLOPT_SSL_CIPHER_LIST         7.9
 CURLOPT_SSL_CTX_DATA            7.10.6
 CURLOPT_SSL_CTX_FUNCTION        7.10.6
+CURLOPT_SSL_OPTIONS             7.25.0
 CURLOPT_SSL_SESSIONID_CACHE     7.16.0
 CURLOPT_SSL_VERIFYHOST          7.8.1
 CURLOPT_SSL_VERIFYPEER          7.4.2
 CURLOPT_STDERR                  7.1
+CURLOPT_TCP_KEEPALIVE           7.25.0
+CURLOPT_TCP_KEEPIDLE            7.25.0
+CURLOPT_TCP_KEEPINTVL           7.25.0
 CURLOPT_TCP_NODELAY             7.11.2
 CURLOPT_TELNETOPTIONS           7.7
 CURLOPT_TFTP_BLKSIZE            7.19.4
@@ -562,7 +567,7 @@ CURLSHOPT_SHARE                 7.10.3
 CURLSHOPT_UNLOCKFUNC            7.10.3
 CURLSHOPT_UNSHARE               7.10.3
 CURLSHOPT_USERDATA              7.10.3
-CURLSOCKTYPE_IPCXN              7.15.6
+CURLSOCKTYPE_IPCXN              7.16.0
 CURLSSH_AUTH_ANY                7.16.1
 CURLSSH_AUTH_DEFAULT            7.16.1
 CURLSSH_AUTH_HOST               7.16.1
@@ -570,6 +575,7 @@ CURLSSH_AUTH_KEYBOARD           7.16.1
 CURLSSH_AUTH_NONE               7.16.1
 CURLSSH_AUTH_PASSWORD           7.16.1
 CURLSSH_AUTH_PUBLICKEY          7.16.1
+CURLSSLOPT_ALLOW_BEAST          7.25.0
 CURLUSESSL_ALL                  7.17.0
 CURLUSESSL_CONTROL              7.17.0
 CURLUSESSL_NONE                 7.17.0
@@ -643,6 +649,7 @@ CURL_READFUNC_PAUSE             7.18.0
 CURL_REDIR_GET_ALL              7.19.1
 CURL_REDIR_POST_301             7.19.1
 CURL_REDIR_POST_302             7.19.1
+CURL_REDIR_POST_303             7.25.1
 CURL_REDIR_POST_ALL             7.19.1
 CURL_RTSPREQ_ANNOUNCE           7.20.0
 CURL_RTSPREQ_DESCRIBE           7.20.0
--- a/docs/mk-ca-bundle.1
+++ b/docs/mk-ca-bundle.1
@@ -0,0 +1,51 @@
+.Dd April 27, 2012
+.Dt MK-CA-BUNDLE 1
+.Os
+.Sh NAME
+.Nm mk-ca-bundle
+.Nd create a new ca-bundle.crt from mozilla's certdata.txt
+.Sh SYNOPSIS
+.Nm
+.Op Fl bilnqtuv
+.Or outputfile
+.Sh DESCRIPTION
+The
+.Nm
+tool downloads the certdata.txt file from Mozilla's source tree, then
+parses certdata.txt and extracts CA Root Certificates into PEM format.
+These are then processed with the OpenSSL commandline tool to produce the
+final ca-bundle.crt file.
+.Sh OPTIONS
+The following options are supported by
+.Nm :
+.Bl -tag -width _h
+.It Fl b
+backup an existing version of ca-bundle.crt
+.It Fl i
+print version info about used modules
+.It Fl l
+print license info about certdata.txt
+.It Fl n
+no download of certdata.txt (to use existing)
+.It Fl q
+be really quiet (no progress output at all)
+.It Fl t
+include plain text listing of certificates
+.It Fl u
+unlink (remove) certdata.txt after processing
+.It Fl v
+be verbose and print out processed CAs
+.El
+.Sh EXIT STATUS
+.Ex -std
+.Sh SEE ALSO
+.Xr curl 1
+.Sh HISTORY
+.Nm
+was based on the parse-certs script written by
+.An Roland Krikava
+and hacked by
+.An Guenter Knauf .
+This manual page was written by
+.An Jan Schaumann
+.Aq jschauma@netmeister.org .
--- a/include/curl/.gitignore
+++ b/include/curl/.gitignore
@@ -1,3 +1,4 @@
 curlbuild.h
+stamp-h2
 stamp-h3
 curlver.h.dist
--- a/include/curl/curl.h
+++ b/include/curl/curl.h
@@ -598,18 +598,32 @@ typedef enum {
                                   in 7.18.0 */
 } curl_proxytype;  /* this enum was added in 7.10 */

-#define CURLAUTH_NONE         0       /* nothing */
-#define CURLAUTH_BASIC        (1<<0)  /* Basic (default) */
-#define CURLAUTH_DIGEST       (1<<1)  /* Digest */
-#define CURLAUTH_GSSNEGOTIATE (1<<2)  /* GSS-Negotiate */
-#define CURLAUTH_NTLM         (1<<3)  /* NTLM */
-#define CURLAUTH_DIGEST_IE    (1<<4)  /* Digest with IE flavour */
-#define CURLAUTH_NTLM_WB      (1<<5)  /* NTLM delegating to winbind helper */
-#define CURLAUTH_ONLY         (1<<31) /* used together with a single other
-                                         type to force no auth or just that
-                                         single type */
-#define CURLAUTH_ANY (~CURLAUTH_DIGEST_IE)  /* all fine types set */
-#define CURLAUTH_ANYSAFE (~(CURLAUTH_BASIC|CURLAUTH_DIGEST_IE))
+/*
+ * Bitmasks for CURLOPT_HTTPAUTH and CURLOPT_PROXYAUTH options:
+ *
+ * CURLAUTH_NONE         - No HTTP authentication
+ * CURLAUTH_BASIC        - HTTP Basic authentication (default)
+ * CURLAUTH_DIGEST       - HTTP Digest authentication
+ * CURLAUTH_GSSNEGOTIATE - HTTP GSS-Negotiate authentication
+ * CURLAUTH_NTLM         - HTTP NTLM authentication
+ * CURLAUTH_DIGEST_IE    - HTTP Digest authentication with IE flavour
+ * CURLAUTH_NTLM_WB      - HTTP NTLM authentication delegated to winbind helper
+ * CURLAUTH_ONLY         - Use together with a single other type to force no
+ *                         authentication or just that single type
+ * CURLAUTH_ANY          - All fine types set
+ * CURLAUTH_ANYSAFE      - All fine types except Basic
+ */
+
+#define CURLAUTH_NONE         ((unsigned long)0)
+#define CURLAUTH_BASIC        (((unsigned long)1)<<0)
+#define CURLAUTH_DIGEST       (((unsigned long)1)<<1)
+#define CURLAUTH_GSSNEGOTIATE (((unsigned long)1)<<2)
+#define CURLAUTH_NTLM         (((unsigned long)1)<<3)
+#define CURLAUTH_DIGEST_IE    (((unsigned long)1)<<4)
+#define CURLAUTH_NTLM_WB      (((unsigned long)1)<<5)
+#define CURLAUTH_ONLY         (((unsigned long)1)<<31)
+#define CURLAUTH_ANY          (~CURLAUTH_DIGEST_IE)
+#define CURLAUTH_ANYSAFE      (~(CURLAUTH_BASIC|CURLAUTH_DIGEST_IE))

 #define CURLSSH_AUTH_ANY       ~0     /* all types supported by the server */
 #define CURLSSH_AUTH_NONE      0      /* none allowed, silly but complete */
@@ -673,6 +687,15 @@ typedef enum {
  CURLUSESSL_LAST     /* not an option, never use */
 } curl_usessl;

+/* Definition of bits for the CURLOPT_SSL_OPTIONS argument: */
+
+/* - ALLOW_BEAST tells libcurl to allow the BEAST SSL vulnerability in the
+   name of improving interoperability with older servers. Some SSL libraries
+   have introduced work-arounds for this flaw but those work-arounds sometimes
+   make the SSL communication fail. To regain functionality with those broken
+   servers, a user can this way allow the vulnerability back. */
+#define CURLSSLOPT_ALLOW_BEAST (1<<0)
+
 #ifndef CURL_NO_OLDIES /* define this to test if your app builds with all
                          the obsolete stuff removed! */

@@ -1499,6 +1522,19 @@ typedef enum {
     of miliseconds. */
  CINIT(ACCEPTTIMEOUT_MS, LONG, 212),

+  /* Set TCP keepalive */
+  CINIT(TCP_KEEPALIVE, LONG, 213),
+
+  /* non-universal keepalive knobs (Linux, AIX, HP-UX, more) */
+  CINIT(TCP_KEEPIDLE, LONG, 214),
+  CINIT(TCP_KEEPINTVL, LONG, 215),
+
+  /* Enable/disable specific SSL features with a bitmask, see CURLSSLOPT_* */
+  CINIT(SSL_OPTIONS, LONG, 216),
+
+  /* set the SMTP auth originator */
+  CINIT(MAIL_AUTH, OBJECTPOINT, 217),
+
  CURLOPT_LASTENTRY /* the last unused */
 } CURLoption;

@@ -1602,13 +1638,16 @@ enum CURL_TLSAUTH {
 };

 /* symbols to use with CURLOPT_POSTREDIR.
-   CURL_REDIR_POST_301 and CURL_REDIR_POST_302 can be bitwise ORed so that
-   CURL_REDIR_POST_301 | CURL_REDIR_POST_302 == CURL_REDIR_POST_ALL */
+   CURL_REDIR_POST_301, CURL_REDIR_POST_302 and CURL_REDIR_POST_303
+   can be bitwise ORed so that CURL_REDIR_POST_301 | CURL_REDIR_POST_302
+   | CURL_REDIR_POST_303 == CURL_REDIR_POST_ALL */

 #define CURL_REDIR_GET_ALL  0
 #define CURL_REDIR_POST_301 1
 #define CURL_REDIR_POST_302 2
-#define CURL_REDIR_POST_ALL (CURL_REDIR_POST_301|CURL_REDIR_POST_302)
+#define CURL_REDIR_POST_303 4
+#define CURL_REDIR_POST_ALL \
+    (CURL_REDIR_POST_301|CURL_REDIR_POST_302|CURL_REDIR_POST_303)

 typedef enum {
  CURL_TIMECOND_NONE,
--- a/include/curl/curlver.h
+++ b/include/curl/curlver.h
@@ -7,7 +7,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -26,16 +26,16 @@
   a script at release-time. This was made its own header file in 7.11.2 */

 /* This is the global package copyright */
-#define LIBCURL_COPYRIGHT "1996 - 2011 Daniel Stenberg, <daniel@haxx.se>."
+#define LIBCURL_COPYRIGHT "1996 - 2012 Daniel Stenberg, <daniel@haxx.se>."

 /* This is the version number of the libcurl package from which this header
   file origins: */
-#define LIBCURL_VERSION "7.24.0-DEV"
+#define LIBCURL_VERSION "7.26.0-DEV"

 /* The numeric version number is also available "in parts" by using these
   defines: */
 #define LIBCURL_VERSION_MAJOR 7
-#define LIBCURL_VERSION_MINOR 24
+#define LIBCURL_VERSION_MINOR 26
 #define LIBCURL_VERSION_PATCH 0

 /* This is the numeric version of the libcurl version number, meant for easier
@@ -53,7 +53,7 @@
   and it is always a greater number in a more recent release. It makes
   comparisons with greater than and less than work.
 */
-#define LIBCURL_VERSION_NUM 0x071800
+#define LIBCURL_VERSION_NUM 0x071A00

 /*
 * This is the date and time when the full source package was created. The
--- a/include/curl/typecheck-gcc.h
+++ b/include/curl/typecheck-gcc.h
@@ -7,7 +7,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -141,8 +141,9 @@ __extension__ ({                                                              \

 /* To define a new warning, use _CURL_WARNING(identifier, "message") */
 #define _CURL_WARNING(id, message)                                            \
-  static void __attribute__((warning(message))) __attribute__((unused))       \
-  __attribute__((noinline)) id(void) { __asm__(""); }
+  static void __attribute__((__warning__(message)))                           \
+  __attribute__((__unused__)) __attribute__((__noinline__))                   \
+  id(void) { __asm__(""); }

 _CURL_WARNING(_curl_easy_setopt_err_long,
  "curl_easy_setopt expects a long argument for this option")
--- a/lib/Makefile.Watcom
+++ b/lib/Makefile.Watcom
@@ -83,13 +83,13 @@ CFLAGS += -dWANT_IDN_PROTOTYPES
 !ifdef %zlib_root
 ZLIB_ROOT = $(%zlib_root)
 !else
-ZLIB_ROOT = ..$(DS)..$(DS)zlib-1.2.5
+ZLIB_ROOT = ..$(DS)..$(DS)zlib-1.2.7
 !endif

 !ifdef %libssh2_root
 LIBSSH2_ROOT = $(%libssh2_root)
 !else
-LIBSSH2_ROOT = ..$(DS)..$(DS)libssh2-1.3.0
+LIBSSH2_ROOT = ..$(DS)..$(DS)libssh2-1.4.2
 !endif

 !ifdef %librtmp_root
@@ -101,7 +101,7 @@ LIBRTMP_ROOT = ..$(DS)..$(DS)rtmpdump-2.3
 !ifdef %openssl_root
 OPENSSL_ROOT = $(%openssl_root)
 !else
-OPENSSL_ROOT = ..$(DS)..$(DS)openssl-0.9.8r
+OPENSSL_ROOT = ..$(DS)..$(DS)openssl-0.9.8x
 !endif

 !ifdef %ares_root
--- a/lib/Makefile.am
+++ b/lib/Makefile.am
@@ -5,7 +5,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+# Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -33,7 +33,7 @@ CMAKE_DIST = CMakeLists.txt curl_config.h.cmake
 EXTRA_DIST = Makefile.b32 Makefile.m32 Makefile.vc6 $(DSP)                 \
 vc6libcurl.dsw config-win32.h config-win32ce.h config-riscos.h            \
 config-mac.h curl_config.h.in makefile.dj config-dos.h libcurl.plist      \
- libcurl.rc config-amigaos.h amigaos.c amigaos.h makefile.amiga		   \
+ libcurl.rc config-amigaos.h makefile.amiga                                \
 Makefile.netware nwlib.c nwos.c libcurl.imp msvcproj.head msvcproj.foot   \
 config-win32ce.h config-os400.h setup-os400.h config-symbian.h		   \
 Makefile.Watcom config-tpf.h $(DOCS) $(VCPROJ) mk-ca-bundle.pl		   \
@@ -48,6 +48,8 @@ LIBCURL_LIBS = @LIBCURL_LIBS@
 # This might hold -Werror
 CFLAGS += @CURL_CFLAG_EXTRAS@

+CFLAG_CURL_SYMBOL_HIDING = @CFLAG_CURL_SYMBOL_HIDING@
+
 # Specify our include paths here, and do it relative to $(top_srcdir) and
 # $(top_builddir), to ensure that these paths which belong to the library
 # being currently built and tested are searched before the library which
@@ -77,6 +79,18 @@ INCLUDES = -I$(top_builddir)/include/curl \
           -I$(top_srcdir)/lib
 endif

+AM_CPPFLAGS =
+
+# Mostly for Windows build targets, when building libcurl library
+if USE_CPPFLAG_BUILDING_LIBCURL
+AM_CPPFLAGS += -DBUILDING_LIBCURL
+endif
+
+# Mostly for Windows build targets, when building static libcurl
+if USE_CPPFLAG_CURL_STATICLIB
+AM_CPPFLAGS += -DCURL_STATICLIB
+endif
+
 if SONAME_BUMP
 #
 # Bumping of SONAME conditionally may seem like a weird thing to do, and yeah
@@ -122,6 +136,14 @@ endif

 libcurl_la_LDFLAGS = $(UNDEF) $(VERSIONINFO) $(MIMPURE) $(VERSIONED_SYMBOLS) $(LIBCURL_LIBS)

+if DOING_CURL_SYMBOL_HIDING
+libcurl_la_CPPFLAGS = $(AM_CPPFLAGS) -DCURL_HIDDEN_SYMBOLS
+libcurl_la_CFLAGS = $(AM_CFLAGS) $(CFLAG_CURL_SYMBOL_HIDING)
+else
+libcurl_la_CPPFLAGS = $(AM_CPPFLAGS)
+libcurl_la_CFLAGS = $(AM_CFLAGS)
+endif
+
 # unit testing static library built only along with unit tests
 if BUILD_UNITTESTS
 noinst_LTLIBRARIES = libcurlu.la
@@ -131,6 +153,7 @@ endif

 libcurlu_la_CPPFLAGS = $(AM_CPPFLAGS) -DUNITTESTS
 libcurlu_la_LDFLAGS = -static $(LIBCURL_LIBS)
+libcurlu_la_CFLAGS = $(AM_CFLAGS)

 # Makefile.inc provides the CSOURCES and HHEADERS defines
 include Makefile.inc
--- a/lib/Makefile.b32
+++ b/lib/Makefile.b32
@@ -22,12 +22,12 @@ BCCDIR = $(MAKEDIR)\..

 # Edit the path below to point to the base of your Zlib sources.
 !ifndef ZLIB_PATH
-ZLIB_PATH = ..\..\zlib-1.2.5
+ZLIB_PATH = ..\..\zlib-1.2.7
 !endif

 # Edit the path below to point to the base of your OpenSSL package.
 !ifndef OPENSSL_PATH
-OPENSSL_PATH = ..\..\openssl-0.9.8q
+OPENSSL_PATH = ..\..\openssl-0.9.8x
 !endif

 # Set libcurl static lib, dll and import lib
--- a/lib/Makefile.inc
+++ b/lib/Makefile.inc
@@ -14,7 +14,7 @@ CSOURCES = file.c timeval.c base64.c hostip.c progress.c formdata.c	\
  curl_fnmatch.c fileinfo.c ftplistparser.c wildcard.c krb5.c		\
  memdebug.c http_chunks.c strtok.c connect.c llist.c hash.c multi.c	\
  content_encoding.c share.c http_digest.c md4.c md5.c curl_rand.c	\
-  http_negotiate.c inet_pton.c strtoofft.c strerror.c			\
+  http_negotiate.c inet_pton.c strtoofft.c strerror.c amigaos.c		\
  hostasyn.c hostip4.c hostip6.c hostsyn.c inet_ntop.c parsedate.c	\
  select.c gtls.c sslgen.c tftp.c splay.c strdup.c socks.c ssh.c nss.c	\
  qssl.c rawstr.c curl_addrinfo.c socks_gssapi.c socks_sspi.c		\
@@ -31,7 +31,7 @@ HHEADERS = arpa_telnet.h netrc.h file.h timeval.h qssl.h hostip.h	\
  getinfo.h strequal.h krb4.h memdebug.h http_chunks.h curl_rand.h	\
  curl_fnmatch.h wildcard.h fileinfo.h ftplistparser.h strtok.h		\
  connect.h llist.h hash.h content_encoding.h share.h curl_md4.h	\
-  curl_md5.h http_digest.h http_negotiate.h inet_pton.h			\
+  curl_md5.h http_digest.h http_negotiate.h inet_pton.h amigaos.h	\
  strtoofft.h strerror.h inet_ntop.h curlx.h curl_memory.h setup.h	\
  transfer.h select.h easyif.h multiif.h parsedate.h sslgen.h gtls.h	\
  tftp.h sockaddr.h splay.h strdup.h setup_once.h socks.h ssh.h nssg.h	\
--- a/lib/Makefile.m32
+++ b/lib/Makefile.m32
@@ -7,18 +7,18 @@
 ## Example: mingw32-make -f Makefile.m32 CFG=-zlib-ssl-sspi-winidn
 ##
 ## Hint: you can also set environment vars to control the build, f.e.:
-## set ZLIB_PATH=c:/zlib-1.2.5
+## set ZLIB_PATH=c:/zlib-1.2.7
 ## set ZLIB=1
 #
 ###########################################################################

 # Edit the path below to point to the base of your Zlib sources.
 ifndef ZLIB_PATH
-ZLIB_PATH = ../../zlib-1.2.5
+ZLIB_PATH = ../../zlib-1.2.7
 endif
 # Edit the path below to point to the base of your OpenSSL package.
 ifndef OPENSSL_PATH
-OPENSSL_PATH = ../../openssl-0.9.8r
+OPENSSL_PATH = ../../openssl-0.9.8x
 endif
 ifndef OPENSSL_INCLUDE
 OPENSSL_INCLUDE = $(OPENSSL_PATH)/outinc
@@ -31,7 +31,7 @@ OPENSSL_LIBS = -leay32 -lssl32
 endif
 # Edit the path below to point to the base of your LibSSH2 package.
 ifndef LIBSSH2_PATH
-LIBSSH2_PATH = ../../libssh2-1.3.0
+LIBSSH2_PATH = ../../libssh2-1.4.2
 endif
 # Edit the path below to point to the base of your librtmp package.
 ifndef LIBRTMP_PATH
--- a/lib/Makefile.netware
+++ b/lib/Makefile.netware
@@ -14,17 +14,17 @@ endif

 # Edit the path below to point to the base of your Zlib sources.
 ifndef ZLIB_PATH
-ZLIB_PATH = ../../zlib-1.2.5
+ZLIB_PATH = ../../zlib-1.2.7
 endif

 # Edit the path below to point to the base of your OpenSSL package.
 ifndef OPENSSL_PATH
-OPENSSL_PATH = ../../openssl-0.9.8r
+OPENSSL_PATH = ../../openssl-0.9.8x
 endif

 # Edit the path below to point to the base of your LibSSH2 package.
 ifndef LIBSSH2_PATH
-LIBSSH2_PATH = ../../libssh2-1.3.0
+LIBSSH2_PATH = ../../libssh2-1.4.2
 endif

 # Edit the path below to point to the base of your axTLS package.
--- a/lib/Makefile.vc6
+++ b/lib/Makefile.vc6
@@ -65,15 +65,15 @@
 !INCLUDE ..\Makefile.msvc.names

 !IFNDEF OPENSSL_PATH
-OPENSSL_PATH   = ../../openssl-0.9.8r
+OPENSSL_PATH   = ../../openssl-0.9.8x
 !ENDIF

 !IFNDEF LIBSSH2_PATH
-LIBSSH2_PATH   = ../../libssh2-1.2.8
+LIBSSH2_PATH   = ../../libssh2-1.4.2
 !ENDIF

 !IFNDEF ZLIB_PATH
-ZLIB_PATH  = ../../zlib-1.2.5
+ZLIB_PATH  = ../../zlib-1.2.7
 !ENDIF

 !IFNDEF MACHINE
--- a/lib/Makefile.vxworks
+++ b/lib/Makefile.vxworks
@@ -33,10 +33,10 @@ BUILD_TYPE := debug
 USER_CFLAGS:=

 # directories where to seek for includes and libraries
-OPENSSL_INC := D:/libraries/openssl/openssl-0.9.8a-vxWorks6.3/include
-OPENSSL_LIB := D:/libraries/openssl/openssl-0.9.8a-vxWorks6.3
-ZLIB_INC    := D:/libraries/zlib/zlib-1.2.3-VxWorks6.3/zlib-1.2.3
-ZLIB_LIB    := D:/libraries/zlib/zlib-1.2.3-VxWorks6.3/binaries/vxworks_3.1_gnu/Debug/lib
+OPENSSL_INC := D:/libraries/openssl/openssl-0.9.8x-vxWorks6.3/include
+OPENSSL_LIB := D:/libraries/openssl/openssl-0.9.8x-vxWorks6.3
+ZLIB_INC    := D:/libraries/zlib/zlib-1.2.7-VxWorks6.3/zlib-1.2.7
+ZLIB_LIB    := D:/libraries/zlib/zlib-1.2.7-VxWorks6.3/binaries/vxworks_3.1_gnu/Debug/lib
 ARES_INC    :=
 ARES_LIB    :=

--- a/lib/amigaos.c
+++ b/lib/amigaos.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2009, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -20,10 +20,13 @@
 *
 ***************************************************************************/

-#ifdef __AMIGA__ /* Any AmigaOS flavour */
+#include "setup.h"
+
+#if defined(__AMIGA__) && !defined(__ixemul__)
+
+#include <amitcp/socketbasetags.h>

 #include "amigaos.h"
-#include <amitcp/socketbasetags.h>

 struct Library *SocketBase = NULL;
 extern int errno, h_errno;
@@ -35,7 +38,7 @@ void __request(const char *msg);
 # define __request( msg )       Printf( msg "\n\a")
 #endif

-void amiga_cleanup()
+void Curl_amiga_cleanup()
 {
  if(SocketBase) {
    CloseLibrary(SocketBase);
@@ -43,7 +46,7 @@ void amiga_cleanup()
  }
 }

-BOOL amiga_init()
+bool Curl_amiga_init()
 {
  if(!SocketBase)
    SocketBase = OpenLibrary("bsdsocket.library", 4);
@@ -61,20 +64,14 @@ BOOL amiga_init()
  }

 #ifndef __libnix__
-  atexit(amiga_cleanup);
+  atexit(Curl_amiga_cleanup);
 #endif

  return TRUE;
 }

 #ifdef __libnix__
-ADD2EXIT(amiga_cleanup,-50);
+ADD2EXIT(Curl_amiga_cleanup,-50);
 #endif

-#else /* __AMIGA__ */
-
-#ifdef __POCC__
-#  pragma warn(disable:2024)  /* Disable warning #2024: Empty input file */
-#endif
-
-#endif /* __AMIGA__ */
+#endif /* __AMIGA__ && ! __ixemul__ */
--- a/lib/amigaos.h
+++ b/lib/amigaos.h
@@ -1,5 +1,5 @@
-#ifndef LIBCURL_AMIGAOS_H
-#define LIBCURL_AMIGAOS_H
+#ifndef HEADER_CURL_AMIGAOS_H
+#define HEADER_CURL_AMIGAOS_H
 /***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
@@ -7,7 +7,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2007, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -21,37 +21,19 @@
 * KIND, either express or implied.
 *
 ***************************************************************************/
+#include "setup.h"

-#ifdef __AMIGA__ /* Any AmigaOS flavour */
+#if defined(__AMIGA__) && !defined(__ixemul__)

-#ifndef __ixemul__
+bool Curl_amiga_init();
+void Curl_amiga_cleanup();

-#include <exec/types.h>
-#include <exec/execbase.h>
+#else

-#include <proto/exec.h>
-#include <proto/dos.h>
+#define Curl_amiga_init() 1
+#define Curl_amiga_cleanup() Curl_nop_stmt

-#include <sys/socket.h>
-
-#include "config-amigaos.h"
-
-#ifndef select
-# define select(args...) WaitSelect( args, NULL)
 #endif
-#ifndef ioctl
-# define ioctl(a,b,c,d)  IoctlSocket( (LONG)a, (ULONG)b, (char*)c)
-#endif
-#define _AMIGASF        1

-extern void amiga_cleanup();
-extern BOOL amiga_init();
-
-#else /* __ixemul__ */
-
-#warning compiling with ixemul...
-
-#endif /* __ixemul__ */
-#endif /* __AMIGA__ */
-#endif /* LIBCURL_AMIGAOS_H */
+#endif /* HEADER_CURL_AMIGAOS_H */

--- a/lib/asyn-ares.c
+++ b/lib/asyn-ares.c
@@ -582,13 +582,22 @@ Curl_addrinfo *Curl_resolver_getaddrinfo(struct connectdata *conn,
    res->last_status = ARES_ENOTFOUND;
 #ifdef ENABLE_IPV6 /* CURLRES_IPV6 */
    if(family == PF_UNSPEC) {
-      res->num_pending = 2;
+      if(Curl_ipv6works()) {
+        res->num_pending = 2;

-      /* areschannel is already setup in the Curl_open() function */
-      ares_gethostbyname((ares_channel)data->state.resolver, hostname,
-                         PF_INET, query_completed_cb, conn);
-      ares_gethostbyname((ares_channel)data->state.resolver, hostname,
-                         PF_INET6, query_completed_cb, conn);
+        /* areschannel is already setup in the Curl_open() function */
+        ares_gethostbyname((ares_channel)data->state.resolver, hostname,
+                            PF_INET, query_completed_cb, conn);
+        ares_gethostbyname((ares_channel)data->state.resolver, hostname,
+                            PF_INET6, query_completed_cb, conn);
+      }
+      else {
+        res->num_pending = 1;
+
+        /* areschannel is already setup in the Curl_open() function */
+        ares_gethostbyname((ares_channel)data->state.resolver, hostname,
+                            PF_INET, query_completed_cb, conn);
+      }
    }
    else
 #endif /* CURLRES_IPV6 */
--- a/lib/base64.c
+++ b/lib/base64.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -58,11 +58,11 @@ static void decodeQuantum(unsigned char *dest, const char *src)
      x = (x << 6);
  }

-  dest[2] = curlx_ultouc(x);
+  dest[2] = curlx_ultouc(x & 0xFFUL);
  x >>= 8;
-  dest[1] = curlx_ultouc(x);
+  dest[1] = curlx_ultouc(x & 0xFFUL);
  x >>= 8;
-  dest[0] = curlx_ultouc(x);
+  dest[0] = curlx_ultouc(x & 0xFFUL);
 }

 /*
--- a/lib/config-amigaos.h
+++ b/lib/config-amigaos.h
@@ -1,5 +1,5 @@
-#ifndef LIBCURL_CONFIG_AMIGAOS_H
-#define LIBCURL_CONFIG_AMIGAOS_H
+#ifndef HEADER_CURL_CONFIG_AMIGAOS_H
+#define HEADER_CURL_CONFIG_AMIGAOS_H
 /***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
@@ -7,7 +7,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -22,6 +22,10 @@
 *
 ***************************************************************************/

+/* ================================================================ */
+/*               Hand crafted config file for AmigaOS               */
+/* ================================================================ */
+
 #ifdef __AMIGA__ /* Any AmigaOS flavour */

 #define HAVE_ARPA_INET_H 1
@@ -72,8 +76,6 @@
 #define HAVE_SYS_STAT_H 1
 #define HAVE_SYS_TIME_H 1
 #define HAVE_SYS_TYPES_H 1
-#define HAVE_TERMIOS_H 1
-#define HAVE_TERMIO_H 1
 #define HAVE_TIME_H 1
 #define HAVE_UNAME 1
 #define HAVE_UNISTD_H 1
@@ -89,11 +91,11 @@
 #define SIZEOF_SHORT 2
 #define SIZEOF_SIZE_T 4

+#define USE_MANUAL 1
 #define USE_OPENSSL 1
 #define USE_SSLEAY 1
 #define CURL_DISABLE_LDAP 1

-
 #define OS "AmigaOS"

 #define PACKAGE "curl"
@@ -114,8 +116,20 @@

 #define in_addr_t int

+#ifndef F_OK
+#  define F_OK 0
+#endif
+
 #ifndef O_RDONLY
-# define O_RDONLY 0x0000
+#  define O_RDONLY 0x0000
+#endif
+
+#ifndef LONG_MAX
+#  define LONG_MAX 0x7fffffffL
+#endif
+
+#ifndef LONG_MIN
+#  define LONG_MIN (-0x7fffffffL-1)
 #endif

 #define HAVE_GETNAMEINFO 1
@@ -150,4 +164,4 @@
 #define SEND_TYPE_RETV int

 #endif /* __AMIGA__ */
-#endif /* LIBCURL_CONFIG_AMIGAOS_H */
+#endif /* HEADER_CURL_CONFIG_AMIGAOS_H */
--- a/lib/config-mac.h
+++ b/lib/config-mac.h
@@ -1,5 +1,5 @@
-#ifndef __LIB_CONFIG_MAC_H
-#define __LIB_CONFIG_MAC_H
+#ifndef HEADER_CURL_CONFIG_MAC_H
+#define HEADER_CURL_CONFIG_MAC_H
 /***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
@@ -7,7 +7,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -23,13 +23,16 @@
 ***************************************************************************/

 /* =================================================================== */
-/*   lib/config-mac.h - Hand crafted config file for Mac OS 9          */
+/*                Hand crafted config file for Mac OS 9                */
 /* =================================================================== */
 /*  On Mac OS X you must run configure to generate curl_config.h file  */
 /* =================================================================== */

 #define OS "mac"

+/* Define if you want the built-in manual */
+#define USE_MANUAL              1
+
 #define HAVE_ERRNO_H            1
 #define HAVE_NETINET_IN_H       1
 #define HAVE_SYS_SOCKET_H       1
@@ -43,15 +46,16 @@
 #define HAVE_FCNTL_H            1
 #define HAVE_SYS_STAT_H         1
 #define HAVE_ALLOCA_H           1
-#define HAVE_TIME_H             1
 #define HAVE_STDLIB_H           1
+#define HAVE_TIME_H             1
 #define HAVE_UTIME_H            1
 #define HAVE_SYS_TIME_H         1
+#define HAVE_SYS_UTIME_H        1

 #define TIME_WITH_SYS_TIME      1

 #define HAVE_ALARM              1
-#define HAVE_STRDUP             1
+#define HAVE_FTRUNCATE          1
 #define HAVE_UTIME              1
 #define HAVE_SETVBUF            1
 #define HAVE_STRFTIME           1
@@ -61,14 +65,13 @@
 #define HAVE_SOCKET             1
 #define HAVE_STRUCT_TIMEVAL     1

-//#define HAVE_STRICMP          1
 #define HAVE_SIGACTION          1
 #define HAVE_SIGNAL_H           1
 #define HAVE_SIG_ATOMIC_T       1

 #ifdef MACOS_SSL_SUPPORT
-#       define USE_SSLEAY       1
-#       define USE_OPENSSL      1
+#  define USE_SSLEAY            1
+#  define USE_OPENSSL           1
 #endif

 #define CURL_DISABLE_LDAP       1
@@ -120,4 +123,4 @@
 #define HAVE_EXTRA_STRICMP_H 1
 #define HAVE_EXTRA_STRDUP_H  1

-#endif /* __LIB_CONFIG_MAC_H */
+#endif /* HEADER_CURL_CONFIG_MAC_H */
--- a/lib/config-os400.h
+++ b/lib/config-os400.h
@@ -1,6 +1,5 @@
-/* ================================================================ */
-/*    lib/config-os400.h - Hand crafted config file for OS/400      */
-/* ================================================================ */
+#ifndef HEADER_CURL_CONFIG_OS400_H
+#define HEADER_CURL_CONFIG_OS400_H
 /***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
@@ -8,7 +7,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -23,6 +22,10 @@
 *
 ***************************************************************************/

+/* ================================================================ */
+/*                Hand crafted config file for OS/400               */
+/* ================================================================ */
+
 #pragma enum(int)

 #undef PACKAGE
@@ -434,10 +437,7 @@
 /* To disable LDAP */
 #undef CURL_DISABLE_LDAP

-/* To avoid external use of library hidden symbols */
-#define CURL_HIDDEN_SYMBOLS
-
-/* External symbols need no special keyword. */
+/* Definition to make a library symbol externally visible. */
 #define CURL_EXTERN_SYMBOL

 /* Define if you have the ldap_url_parse procedure. */
@@ -542,3 +542,4 @@
 #define qadrt_use_fread_inline         /* Generate fread() wrapper inline. */
 #define qadrt_use_fwrite_inline        /* Generate fwrite() wrapper inline. */

+#endif /* HEADER_CURL_CONFIG_OS400_H */
--- a/lib/config-riscos.h
+++ b/lib/config-riscos.h
@@ -1,11 +1,13 @@
-/* curl_config.h.in.  Generated automatically from configure.in by autoheader. /***************************************************************************
+#ifndef HEADER_CURL_CONFIG_RISCOS_H
+#define HEADER_CURL_CONFIG_RISCOS_H
+/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -19,7 +21,11 @@
 * KIND, either express or implied.
 *
 ***************************************************************************/
- */
+
+/* ================================================================ */
+/*               Hand crafted config file for RISC OS               */
+/* ================================================================ */
+
 /* Name of this package! */
 #undef PACKAGE

@@ -32,6 +38,9 @@
 /* Define cpu-machine-OS */
 #define OS "ARM-RISC OS"

+/* Define if you want the built-in manual */
+#define USE_MANUAL
+
 /* Define if you have the gethostbyaddr_r() function with 5 arguments */
 #undef HAVE_GETHOSTBYADDR_R_5

@@ -74,8 +83,8 @@
 /* Define if you want to enable IPv6 support */
 #undef ENABLE_IPV6

-/* Define to 1 if you have the alarm function. */
-#define HAVE_ALARM 1
+/* Define if you have the alarm function. */
+#define HAVE_ALARM

 /* Define if you have the <alloca.h> header file. */
 #define HAVE_ALLOCA_H
@@ -101,6 +110,9 @@
 /* Define if you have the <fcntl.h> header file. */
 #define HAVE_FCNTL_H

+/* Define if you have the `ftruncate' function. */
+#define HAVE_FTRUNCATE
+
 /* Define if getaddrinfo exists and works */
 #define HAVE_GETADDRINFO

@@ -144,7 +156,7 @@
 #define HAVE_INTTYPES_H

 /* Define if you have the <io.h> header file. */
-#define HAVE_IO_H
+#undef HAVE_IO_H

 /* Define if you have the `krb_get_our_ip_for_realm' function. */
 #undef HAVE_KRB_GET_OUR_IP_FOR_REALM
@@ -462,8 +474,8 @@
 /* Define to the type pointed by arg 2 for recvfrom. */
 #define RECVFROM_TYPE_ARG2 void

-/* Define to 1 if the type pointed by arg 2 for recvfrom is void. */
-#define RECVFROM_TYPE_ARG2_IS_VOID 1
+/* Define if the type pointed by arg 2 for recvfrom is void. */
+#define RECVFROM_TYPE_ARG2_IS_VOID

 /* Define to the type of arg 3 for recvfrom. */
 #define RECVFROM_TYPE_ARG3 size_t
@@ -500,3 +512,5 @@

 /* Define to the function return type for send. */
 #define SEND_TYPE_RETV ssize_t
+
+#endif /* HEADER_CURL_CONFIG_RISCOS_H */
--- a/lib/config-symbian.h
+++ b/lib/config-symbian.h
@@ -1,4 +1,5 @@
-/* config-symbian.h.  Manually generated.  */
+#ifndef HEADER_CURL_CONFIG_SYMBIAN_H
+#define HEADER_CURL_CONFIG_SYMBIAN_H
 /***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
@@ -6,7 +7,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -21,8 +22,9 @@
 *
 ***************************************************************************/

-/* when building libcurl itself */
-/* #undef BUILDING_LIBCURL */
+/* ================================================================ */
+/*               Hand crafted config file for Symbian               */
+/* ================================================================ */

 /* Location of default ca bundle */
 /* #define CURL_CA_BUNDLE "/etc/pki/tls/certs/ca-bundle.crt"*/
@@ -63,18 +65,12 @@
 /* to disable verbose strings */
 /* #define CURL_DISABLE_VERBOSE_STRINGS 1*/

-/* to make a symbol visible */
-/*#define CURL_EXTERN_SYMBOL  __declspec(dllexport)*/
-
-/* to enable hidden symbols */
-/*#define CURL_HIDDEN_SYMBOLS 1*/
+/* Definition to make a library symbol externally visible. */
+/* #undef CURL_EXTERN_SYMBOL */

 /* Use Windows LDAP implementation */
 /* #undef CURL_LDAP_WIN */

-/* when not building a shared library */
-/* #undef CURL_STATICLIB */
-
 /* your Entropy Gathering Daemon socket pathname */
 /* #undef EGD_SOCKET */

@@ -400,9 +396,6 @@
 /* Define to 1 if you have the `pipe' function. */
 #define HAVE_PIPE 1

-/* if you have the function PK11_CreateGenericObject */
-/* #undef HAVE_PK11_CREATEGENERICOBJECT */
-
 /* Define to 1 if you have the `poll' function. */
 /*#define HAVE_POLL 1*/

@@ -646,9 +639,6 @@
 /* Define to 1 if you have the <x509.h> header file. */
 /* #undef HAVE_X509_H */

-/* Define to 1 if you are building a native Windows target. */
-/* #undef NATIVE_WINDOWS */
-
 /* Define to 1 if you need the lber.h header file even with ldap.h */
 /* #undef NEED_LBER_H */

@@ -830,3 +820,5 @@
 /* if OpenSSL is in use */
 #define USE_OPENSSL
 #endif
+
+#endif /* HEADER_CURL_CONFIG_SYMBIAN_H */
--- a/lib/config-tpf.h
+++ b/lib/config-tpf.h
@@ -1,5 +1,5 @@
-#ifndef __LIBCONFIGTPF_H
-#define __LIBCONFIGTPF_H
+#ifndef HEADER_CURL_CONFIG_TPF_H
+#define HEADER_CURL_CONFIG_TPF_H
 /***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
@@ -7,7 +7,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -23,7 +23,7 @@
 ***************************************************************************/

 /* ================================================================ */
-/*    lib/config-tpf.h - Hand crafted config file for TPF           */
+/*                 Hand crafted config file for TPF                 */
 /* ================================================================ */

 /* ---------------------------------------------------------------- */
@@ -32,9 +32,6 @@

 /* NOTE: Refer also to the .mak file for some of the flags below */

-/* when building libcurl itself */
-/* #undef BUILDING_LIBCURL */
-
 /* to disable cookies support */
 /* #undef CURL_DISABLE_COOKIES */

@@ -65,9 +62,6 @@
 /* to disable verbose strings */
 /* #undef CURL_DISABLE_VERBOSE_STRINGS */

-/* when not building a shared library */
-/* #undef CURL_STATICLIB */
-
 /* lber dynamic library file */
 /* #undef DL_LBER_FILE */

@@ -779,4 +773,4 @@
 #endif


-#endif /* __LIBCONFIGTPF_H */
+#endif /* HEADER_CURL_CONFIG_TPF_H */
--- a/lib/config-vxworks.h
+++ b/lib/config-vxworks.h
@@ -1,5 +1,5 @@
-#ifndef __LIB_CONFIG_VXWORKS_H
-#define __LIB_CONFIG_VXWORKS_H
+#ifndef HEADER_CURL_CONFIG_VXWORKS_H
+#define HEADER_CURL_CONFIG_VXWORKS_H
 /***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
@@ -7,7 +7,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -23,12 +23,9 @@
 ***************************************************************************/

 /* =============================================================== */
-/*   lib/config-vxworks.h - Hand crafted config file for VxWorks   */
+/*               Hand crafted config file for VxWorks              */
 /* =============================================================== */

-/* when building libcurl itself */
-/* #undef BUILDING_LIBCURL */
-
 /* Location of default ca bundle */
 /* #undef CURL_CA_BUNDLE */

@@ -74,18 +71,12 @@
 /* to disable verbose strings */
 /* #undef CURL_DISABLE_VERBOSE_STRINGS */

-/* to make a symbol visible */
+/* Definition to make a library symbol externally visible. */
 /* #undef CURL_EXTERN_SYMBOL */

-/* to enable hidden symbols */
-/* #undef CURL_HIDDEN_SYMBOLS */
-
 /* Use Windows LDAP implementation */
 /* #undef CURL_LDAP_WIN */

-/* when not building a shared library */
-/* #undef CURL_STATICLIB */
-
 /* your Entropy Gathering Daemon socket pathname */
 /* #undef EGD_SOCKET */

@@ -469,9 +460,6 @@
 /* Define to 1 if you have the `pipe' function. */
 #define HAVE_PIPE 1

-/* if you have the function PK11_CreateGenericObject */
-/* #undef HAVE_PK11_CREATEGENERICOBJECT */
-
 /* Define to 1 if you have a working poll function. */
 /* #undef HAVE_POLL */

@@ -745,9 +733,6 @@
 /* if you have the zlib.h header file */
 #define HAVE_ZLIB_H 1

-/* Define to 1 if you are building a native Windows target. */
-/* #undef NATIVE_WINDOWS */
-
 /* Define to 1 if you need the lber.h header file even with ldap.h */
 /* #undef NEED_LBER_H */

@@ -952,4 +937,4 @@
 /* the signed version of size_t */
 /* #undef ssize_t */

-#endif /* __LIB_CONFIG_VXWORKS_H */
+#endif /* HEADER_CURL_CONFIG_VXWORKS_H */
--- a/lib/connect.c
+++ b/lib/connect.c
@@ -91,6 +91,35 @@

 static bool verifyconnect(curl_socket_t sockfd, int *error);

+static void
+tcpkeepalive(struct SessionHandle *data,
+             curl_socket_t sockfd)
+{
+  int optval = data->set.tcp_keepalive?1:0;
+
+  /* only set IDLE and INTVL if setting KEEPALIVE is successful */
+  if(setsockopt(sockfd, SOL_SOCKET, SO_KEEPALIVE,
+        (void *)&optval, sizeof(optval)) < 0) {
+    infof(data, "Failed to set SO_KEEPALIVE on fd %d\n", sockfd);
+  }
+  else {
+#ifdef TCP_KEEPIDLE
+    optval = curlx_sltosi(data->set.tcp_keepidle);
+    if(setsockopt(sockfd, IPPROTO_TCP, TCP_KEEPIDLE,
+          (void *)&optval, sizeof(optval)) < 0) {
+      infof(data, "Failed to set TCP_KEEPIDLE on fd %d\n", sockfd);
+    }
+#endif
+#ifdef TCP_KEEPINTVL
+    optval = curlx_sltosi(data->set.tcp_keepintvl);
+    if(setsockopt(sockfd, IPPROTO_TCP, TCP_KEEPINTVL,
+          (void *)&optval, sizeof(optval)) < 0) {
+      infof(data, "Failed to set TCP_KEEPINTVL on fd %d\n", sockfd);
+    }
+#endif
+  }
+}
+
 static CURLcode
 singleipconnect(struct connectdata *conn,
                const Curl_addrinfo *ai, /* start connecting to this */
@@ -732,6 +761,8 @@ CURLcode Curl_is_connected(struct connectdata *conn,
  }
  next:

+  conn->timeoutms_per_addr = conn->ip_addr->ai_next == NULL ?
+                             allow : allow / 2;
  code = trynextip(conn, sockindex, connected);

  if(code) {
@@ -850,7 +881,10 @@ singleipconnect(struct connectdata *conn,

  res = Curl_socket(conn, ai, &addr, &sockfd);
  if(res)
-    return res;
+    /* Failed to create the socket, but still return OK since we signal the
+       lack of socket as well. This allows the parent function to keep looping
+       over alternative addresses/socket families etc. */
+    return CURLE_OK;

  /* store remote address and port used in this connection attempt */
  if(!getaddressinfo((struct sockaddr*)&addr.sa_addr,
@@ -874,6 +908,9 @@ singleipconnect(struct connectdata *conn,

  Curl_sndbufset(sockfd);

+  if(data->set.tcp_keepalive)
+    tcpkeepalive(data, sockfd);
+
  if(data->set.fsockopt) {
    /* activate callback for setting socket options */
    error = data->set.fsockopt(data->set.sockopt_client,
@@ -989,7 +1026,6 @@ CURLcode Curl_connecthost(struct connectdata *conn,  /* context */
 {
  struct SessionHandle *data = conn->data;
  curl_socket_t sockfd = CURL_SOCKET_BAD;
-  int aliasindex;
  Curl_addrinfo *ai;
  Curl_addrinfo *curr_addr;

@@ -1013,9 +1049,7 @@ CURLcode Curl_connecthost(struct connectdata *conn,  /* context */
    return CURLE_OPERATION_TIMEDOUT;
  }

-  /* Max time for each address */
  conn->num_addr = Curl_num_addresses(remotehost->addr);
-  conn->timeoutms_per_addr = timeout_ms / conn->num_addr;

  ai = remotehost->addr;

@@ -1026,16 +1060,18 @@ CURLcode Curl_connecthost(struct connectdata *conn,  /* context */
  /*
   * Connecting with a Curl_addrinfo chain
   */
-  for(curr_addr = ai, aliasindex=0; curr_addr;
-      curr_addr = curr_addr->ai_next, aliasindex++) {
+  for(curr_addr = ai; curr_addr; curr_addr = curr_addr->ai_next) {
+    CURLcode res;
+
+    /* Max time for the next address */
+    conn->timeoutms_per_addr = curr_addr->ai_next == NULL ?
+                               timeout_ms : timeout_ms / 2;

    /* start connecting to the IP curr_addr points to */
-    CURLcode res =
-      singleipconnect(conn, curr_addr,
-                      /* don't hang when doing multi */
-                      (data->state.used_interface == Curl_if_multi)?0:
-                      conn->timeoutms_per_addr, &sockfd, connected);
-
+    res = singleipconnect(conn, curr_addr,
+                          /* don't hang when doing multi */
+                          (data->state.used_interface == Curl_if_multi)?0:
+                          conn->timeoutms_per_addr, &sockfd, connected);
    if(res)
      return res;

@@ -1195,7 +1231,7 @@ CURLcode Curl_socket(struct connectdata *conn,

  if(*sockfd == CURL_SOCKET_BAD)
    /* no socket, no connection */
-    return CURLE_FAILED_INIT;
+    return CURLE_COULDNT_CONNECT;

 #if defined(ENABLE_IPV6) && defined(HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID)
  if(conn->scope && (addr->family == AF_INET6)) {
--- a/lib/curl_config.h.cmake
+++ b/lib/curl_config.h.cmake
@@ -1,4 +1,4 @@
-/* lib/curl_config.h.in.  Generated from configure.ac by autoheader.  */
+/* lib/curl_config.h.in.  Generated somehow by cmake.  */

 /* when building libcurl itself */
 #cmakedefine BUILDING_LIBCURL ${BUILDING_LIBCURL}
@@ -52,9 +52,6 @@
 #define CURL_EXTERN_SYMBOL
 #endif

-/* to enable hidden symbols */
-#cmakedefine CURL_HIDDEN_SYMBOLS ${CURL_HIDDEN_SYMBOLS}
-
 /* Use Windows LDAP implementation */
 #cmakedefine CURL_LDAP_WIN ${CURL_LDAP_WIN}

@@ -444,9 +441,6 @@
 /* Define to 1 if you have the `pipe' function. */
 #cmakedefine HAVE_PIPE ${HAVE_PIPE}

-/* if you have the function PK11_CreateGenericObject */
-#cmakedefine HAVE_PK11_CREATEGENERICOBJECT ${HAVE_PK11_CREATEGENERICOBJECT}
-
 /* Define to 1 if you have a working poll function. */
 #cmakedefine HAVE_POLL ${HAVE_POLL}

@@ -724,9 +718,6 @@
   */
 #cmakedefine LT_OBJDIR ${LT_OBJDIR}

-/* Define to 1 if you are building a native Windows target. */
-#cmakedefine NATIVE_WINDOWS ${NATIVE_WINDOWS}
-
 /* If you lack a fine basename() prototype */
 #cmakedefine NEED_BASENAME_PROTO ${NEED_BASENAME_PROTO}

--- a/lib/curl_md5.h
+++ b/lib/curl_md5.h
@@ -25,10 +25,39 @@
 #ifndef CURL_DISABLE_CRYPTO_AUTH
 #include "curl_hmac.h"

+#define MD5_DIGEST_LEN  16
+
+typedef void (* Curl_MD5_init_func)(void *context);
+typedef void (* Curl_MD5_update_func)(void *context,
+                                      const unsigned char *data,
+                                      unsigned int len);
+typedef void (* Curl_MD5_final_func)(unsigned char *result, void *context);
+
+typedef struct {
+  Curl_MD5_init_func     md5_init_func;   /* Initialize context procedure */
+  Curl_MD5_update_func   md5_update_func; /* Update context with data */
+  Curl_MD5_final_func    md5_final_func;  /* Get final result procedure */
+  unsigned int           md5_ctxtsize;  /* Context structure size */
+  unsigned int           md5_resultlen; /* Result length (bytes) */
+} MD5_params;
+
+typedef struct {
+  const MD5_params      *md5_hash;      /* Hash function definition */
+  void                  *md5_hashctx;   /* Hash function context */
+} MD5_context;
+
+extern const MD5_params Curl_DIGEST_MD5[1];
 extern const HMAC_params Curl_HMAC_MD5[1];

 void Curl_md5it(unsigned char *output,
                const unsigned char *input);
+
+MD5_context * Curl_MD5_init(const MD5_params *md5params);
+int Curl_MD5_update(MD5_context *context,
+                    const unsigned char *data,
+                    unsigned int len);
+int Curl_MD5_final(MD5_context *context, unsigned char *result);
+
 #endif

 #endif /* HEADER_CURL_MD5_H */
--- a/lib/curl_ntlm_core.c
+++ b/lib/curl_ntlm_core.c
@@ -145,7 +145,7 @@ static void setup_des_key(const unsigned char *key_56,
 {
  char key[8];
  extend_key_56_to_64(key_56, key);
-  des_set_key(des, key);
+  des_set_key(des, (const uint8_t*)key);
 }

 #elif defined(USE_GNUTLS)
@@ -389,7 +389,7 @@ CURLcode Curl_ntlm_core_mk_nt_hash(struct SessionHandle *data,
 #elif defined(USE_GNUTLS_NETTLE)
    struct md4_ctx MD4pw;
    md4_init(&MD4pw);
-    md4_update(&MD4pw, 2 * len, pw);
+    md4_update(&MD4pw, (unsigned int)(2 * len), pw);
    md4_digest(&MD4pw, MD4_DIGEST_SIZE, ntbuffer);
 #elif defined(USE_GNUTLS)
    gcry_md_hd_t MD4pw;
--- a/lib/cyassl.c
+++ b/lib/cyassl.c
@@ -404,14 +404,10 @@ size_t Curl_cyassl_version(char *buffer, size_t size)

 int Curl_cyassl_init(void)
 {
-#if (LIBCYASSL_VERSION_HEX >= 0x02000000)
-  if(SSL_library_init() != SSL_SUCCESS)
-    return 0;
-#else
-  InitCyaSSL();
-#endif
+  if(CyaSSL_Init() == 0)
+    return 1;

-  return 1;
+  return -1;
 }


--- a/lib/easy.c
+++ b/lib/easy.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -66,6 +66,7 @@
 #include "curl_ntlm.h"
 #include "connect.h" /* for Curl_getconnectinfo */
 #include "slist.h"
+#include "amigaos.h"
 #include "curl_rand.h"
 #include "non-ascii.h"
 #include "warnless.h"
@@ -238,8 +239,8 @@ CURLcode curl_global_init(long flags)
    }

 #ifdef __AMIGA__
-  if(!amiga_init()) {
-    DEBUGF(fprintf(stderr, "Error: amiga_init failed\n"));
+  if(!Curl_amiga_init()) {
+    DEBUGF(fprintf(stderr, "Error: Curl_amiga_init failed\n"));
    return CURLE_FAILED_INIT;
  }
 #endif
@@ -328,9 +329,7 @@ void curl_global_cleanup(void)
  if(init_flags & CURL_GLOBAL_WIN32)
    win32_cleanup();

-#ifdef __AMIGA__
-  amiga_cleanup();
-#endif
+  Curl_amiga_cleanup();

 #if defined(USE_LIBSSH2) && defined(HAVE_LIBSSH2_EXIT)
  (void)libssh2_exit();
--- a/lib/ftp.c
+++ b/lib/ftp.c
@@ -3197,33 +3197,6 @@ static CURLcode ftp_connect(struct connectdata *conn,
  pp->endofresp = ftp_endofresp;
  pp->conn = conn;

-  if(conn->bits.tunnel_proxy && conn->bits.httpproxy) {
-    /* for FTP over HTTP proxy */
-    struct HTTP http_proxy;
-    struct FTP *ftp_save;
-
-    /* BLOCKING */
-    /* We want "seamless" FTP operations through HTTP proxy tunnel */
-
-    /* Curl_proxyCONNECT is based on a pointer to a struct HTTP at the member
-     * conn->proto.http; we want FTP through HTTP and we have to change the
-     * member temporarily for connecting to the HTTP proxy. After
-     * Curl_proxyCONNECT we have to set back the member to the original struct
-     * FTP pointer
-     */
-    ftp_save = data->state.proto.ftp;
-    memset(&http_proxy, 0, sizeof(http_proxy));
-    data->state.proto.http = &http_proxy;
-
-    result = Curl_proxyCONNECT(conn, FIRSTSOCKET,
-                               conn->host.name, conn->remote_port);
-
-    data->state.proto.ftp = ftp_save;
-
-    if(CURLE_OK != result)
-      return result;
-  }
-
  if(conn->handler->flags & PROTOPT_SSL) {
    /* BLOCKING */
    result = Curl_ssl_connect(conn, FIRSTSOCKET);
@@ -3851,15 +3824,17 @@ static CURLcode init_wc_data(struct connectdata *conn)
     resources for wildcard transfer */

  /* allocate ftp protocol specific temporary wildcard data */
-  ftp_tmp = malloc(sizeof(struct ftp_wc_tmpdata));
+  ftp_tmp = calloc(1, sizeof(struct ftp_wc_tmpdata));
  if(!ftp_tmp) {
+    Curl_safefree(wildcard->pattern);
    return CURLE_OUT_OF_MEMORY;
  }

  /* INITIALIZE parselist structure */
  ftp_tmp->parser = Curl_ftp_parselist_data_alloc();
  if(!ftp_tmp->parser) {
-    free(ftp_tmp);
+    Curl_safefree(wildcard->pattern);
+    Curl_safefree(ftp_tmp);
    return CURLE_OUT_OF_MEMORY;
  }

@@ -3873,9 +3848,22 @@ static CURLcode init_wc_data(struct connectdata *conn)
  /* try to parse ftp url */
  ret = ftp_parse_url_path(conn);
  if(ret) {
+    Curl_safefree(wildcard->pattern);
+    wildcard->tmp_dtor(wildcard->tmp);
+    wildcard->tmp_dtor = ZERO_NULL;
+    wildcard->tmp = NULL;
    return ret;
  }

+  wildcard->path = strdup(conn->data->state.path);
+  if(!wildcard->path) {
+    Curl_safefree(wildcard->pattern);
+    wildcard->tmp_dtor(wildcard->tmp);
+    wildcard->tmp_dtor = ZERO_NULL;
+    wildcard->tmp = NULL;
+    return CURLE_OUT_OF_MEMORY;
+  }
+
  /* backup old write_function */
  ftp_tmp->backup.write_function = conn->data->set.fwrite_func;
  /* parsing write function */
@@ -3885,11 +3873,6 @@ static CURLcode init_wc_data(struct connectdata *conn)
  /* let the writefunc callback know what curl pointer is working with */
  conn->data->set.out = conn;

-  wildcard->path = strdup(conn->data->state.path);
-  if(!wildcard->path) {
-    return CURLE_OUT_OF_MEMORY;
-  }
-
  infof(conn->data, "Wildcard - Parsing started\n");
  return CURLE_OK;
 }
@@ -3916,6 +3899,8 @@ static CURLcode wc_statemach(struct connectdata *conn)
    struct ftp_wc_tmpdata *ftp_tmp = wildcard->tmp;
    conn->data->set.fwrite_func = ftp_tmp->backup.write_function;
    conn->data->set.out = ftp_tmp->backup.file_descriptor;
+    ftp_tmp->backup.write_function = ZERO_NULL;
+    ftp_tmp->backup.file_descriptor = NULL;
    wildcard->state = CURLWC_DOWNLOADING;

    if(Curl_ftp_parselist_geterror(ftp_tmp->parser)) {
@@ -4271,7 +4256,8 @@ CURLcode ftp_parse_url_path(struct connectdata *conn)
        return CURLE_OUT_OF_MEMORY;

      ftpc->dirs[0] = curl_easy_unescape(conn->data, slash_pos ? cur_pos : "/",
-                                         slash_pos?(int)(slash_pos-cur_pos):1,
+                                         slash_pos ?
+                                         curlx_sztosi(slash_pos-cur_pos) : 1,
                                         NULL);
      if(!ftpc->dirs[0]) {
        freedirs(ftpc);
@@ -4310,7 +4296,7 @@ CURLcode ftp_parse_url_path(struct connectdata *conn)
          /* we skip empty path components, like "x//y" since the FTP command
             CWD requires a parameter and a non-existent parameter a) doesn't
             work on many servers and b) has no effect on the others. */
-          int len = (int)(slash_pos - cur_pos + absolute_dir);
+          int len = curlx_sztosi(slash_pos - cur_pos + absolute_dir);
          ftpc->dirs[ftpc->dirdepth] =
            curl_easy_unescape(conn->data, cur_pos - absolute_dir, len, NULL);
          if(!ftpc->dirs[ftpc->dirdepth]) { /* run out of memory ... */
@@ -4381,8 +4367,8 @@ CURLcode ftp_parse_url_path(struct connectdata *conn)
      return CURLE_OUT_OF_MEMORY;
    }

-    dlen -= ftpc->file?(int)strlen(ftpc->file):0;
-    if((dlen == (int)strlen(ftpc->prevpath)) &&
+    dlen -= ftpc->file?curlx_uztosi(strlen(ftpc->file)):0;
+    if((dlen == curlx_uztosi(strlen(ftpc->prevpath))) &&
       strnequal(path, ftpc->prevpath, dlen)) {
      infof(data, "Request has same path as previous transfer\n");
      ftpc->cwddone = TRUE;
--- a/lib/getinfo.c
+++ b/lib/getinfo.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2010, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -87,6 +87,11 @@ CURLcode Curl_getinfo(struct SessionHandle *data, CURLINFO info, ...)
    struct curl_slist    * to_slist;
  } ptr;

+  union {
+    unsigned long *to_ulong;
+    long          *to_long;
+  } lptr;
+
  if(!data)
    return CURLE_BAD_FUNCTION_ARGUMENT;

@@ -191,10 +196,12 @@ CURLcode Curl_getinfo(struct SessionHandle *data, CURLINFO info, ...)
    *param_charp = (char *) data->set.private_data;
    break;
  case CURLINFO_HTTPAUTH_AVAIL:
-    *param_longp = data->info.httpauthavail;
+    lptr.to_long = param_longp;
+    *lptr.to_ulong = data->info.httpauthavail;
    break;
  case CURLINFO_PROXYAUTH_AVAIL:
-    *param_longp = data->info.proxyauthavail;
+    lptr.to_long = param_longp;
+    *lptr.to_ulong = data->info.proxyauthavail;
    break;
  case CURLINFO_OS_ERRNO:
    *param_longp = data->state.os_errno;
--- a/lib/http.c
+++ b/lib/http.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -284,7 +284,7 @@ static bool pickoneauth(struct auth *pick)
 {
  bool picked;
  /* only deal with authentication we want */
-  long avail = pick->avail & pick->want;
+  unsigned long avail = pick->avail & pick->want;
  picked = TRUE;

  /* The order of these checks is highly relevant, as this will be the order
@@ -697,7 +697,7 @@ CURLcode Curl_http_input_auth(struct connectdata *conn,
   */
  struct SessionHandle *data = conn->data;

-  long *availp;
+  unsigned long *availp;
  const char *start;
  struct auth *authp;

@@ -1088,7 +1088,7 @@ CURLcode Curl_add_buffer_send(Curl_send_buffer *in,
    if(conn->data->set.verbose) {
      /* this data _may_ contain binary stuff */
      Curl_debug(conn->data, CURLINFO_HEADER_OUT, ptr, headlen, conn);
-      if((size_t)amount > headlen) {
+      if(bodylen) {
        /* there was body data sent beyond the initial header part, pass that
           on to the debug callback too */
        Curl_debug(conn->data, CURLINFO_DATA_OUT,
@@ -1309,27 +1309,17 @@ CURLcode Curl_http_connect(struct connectdata *conn, bool *done)
     function to make the re-use checks properly be able to check this bit. */
  conn->bits.close = FALSE;

-#ifndef CURL_DISABLE_PROXY
-  /* If we are not using a proxy and we want a secure connection, perform SSL
-   * initialization & connection now.  If using a proxy with https, then we
-   * must tell the proxy to CONNECT to the host we want to talk to.  Only
-   * after the connect has occurred, can we start talking SSL
-   */
-  if(conn->bits.tunnel_proxy && conn->bits.httpproxy) {
-
-    /* either SSL over proxy, or explicitly asked for */
-    result = Curl_proxyCONNECT(conn, FIRSTSOCKET,
-                               conn->host.name,
-                               conn->remote_port);
-    if(CURLE_OK != result)
+  if(data->state.used_interface == Curl_if_multi) {
+    /* when the multi interface is used, the CONNECT procedure might not have
+       been completed */
+    result = Curl_proxy_connect(conn);
+    if(result)
      return result;
  }

-  if(conn->bits.tunnel_connecting) {
+  if(conn->tunnel_state[FIRSTSOCKET] == TUNNEL_CONNECT)
    /* nothing else to do except wait right now - we're not done here. */
    return CURLE_OK;
-  }
-#endif /* CURL_DISABLE_PROXY */

  if(conn->given->flags & PROTOPT_SSL) {
    /* perform SSL initialization */
@@ -1857,9 +1847,23 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
      /* ignore empty data */
      free(cookiehost);
    else {
-      char *colon = strchr(cookiehost, ':');
-      if(colon)
-        *colon = 0; /* The host must not include an embedded port number */
+      /* If the host begins with '[', we start searching for the port after
+         the bracket has been closed */
+      int startsearch = 0;
+      if(*cookiehost == '[') {
+        char *closingbracket;
+        /* since the 'cookiehost' is an allocated memory area that will be
+           freed later we cannot simply increment the pointer */
+        memmove(cookiehost, cookiehost + 1, strlen(cookiehost) - 1);
+        closingbracket = strchr(cookiehost, ']');
+        if(closingbracket)
+          *closingbracket = 0;
+      }
+      else {
+        char *colon = strchr(cookiehost + startsearch, ':');
+        if(colon)
+          *colon = 0; /* The host must not include an embedded port number */
+      }
      Curl_safefree(conn->allocptr.cookiehost);
      conn->allocptr.cookiehost = cookiehost;
    }
@@ -2476,11 +2480,13 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
          included_body = postsize;
        }
        else {
-          /* Append the POST data chunky-style */
-          result = Curl_add_bufferf(req_buffer, "%x\r\n", (int)postsize);
-          if(CURLE_OK == result)
-            result = Curl_add_buffer(req_buffer, data->set.postfields,
-                                     (size_t)postsize);
+          if(postsize) {
+            /* Append the POST data chunky-style */
+            result = Curl_add_bufferf(req_buffer, "%x\r\n", (int)postsize);
+            if(CURLE_OK == result)
+              result = Curl_add_buffer(req_buffer, data->set.postfields,
+                                       (size_t)postsize);
+          }
          if(CURLE_OK == result)
            result = Curl_add_buffer(req_buffer,
                                     "\x0d\x0a\x30\x0d\x0a\x0d\x0a", 7);
--- a/lib/http_digest.c
+++ b/lib/http_digest.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -34,6 +34,7 @@
 #include "url.h" /* for Curl_safefree() */
 #include "curl_memory.h"
 #include "non-ascii.h" /* included for Curl_convert_... prototypes */
+#include "warnless.h"

 #define _MPRINTF_REPLACE /* use our functions only */
 #include <curl/mprintf.h>
@@ -416,7 +417,8 @@ CURLcode Curl_output_digest(struct connectdata *conn,
  */
  if(authp->iestyle && ((tmp = strchr((char *)uripath, '?')) != NULL)) {
    md5this = (unsigned char *)aprintf("%s:%.*s", request,
-                                       (int)(tmp - (char *)uripath), uripath);
+                                       curlx_sztosi(tmp - (char *)uripath),
+                                       uripath);
  }
  else
    md5this = (unsigned char *)aprintf("%s:%s", request, uripath);
--- a/lib/http_proxy.c
+++ b/lib/http_proxy.c
@@ -48,6 +48,40 @@
 /* The last #include file should be: */
 #include "memdebug.h"

+CURLcode Curl_proxy_connect(struct connectdata *conn)
+{
+  if(conn->bits.tunnel_proxy && conn->bits.httpproxy) {
+#ifndef CURL_DISABLE_PROXY
+    /* for [protocol] tunneled through HTTP proxy */
+    struct HTTP http_proxy;
+    void *prot_save;
+    CURLcode result;
+
+    /* BLOCKING */
+    /* We want "seamless" operations through HTTP proxy tunnel */
+
+    /* Curl_proxyCONNECT is based on a pointer to a struct HTTP at the
+     * member conn->proto.http; we want [protocol] through HTTP and we have
+     * to change the member temporarily for connecting to the HTTP
+     * proxy. After Curl_proxyCONNECT we have to set back the member to the
+     * original pointer
+     */
+    prot_save = conn->data->state.proto.generic;
+    memset(&http_proxy, 0, sizeof(http_proxy));
+    conn->data->state.proto.http = &http_proxy;
+    result = Curl_proxyCONNECT(conn, FIRSTSOCKET,
+                               conn->host.name, conn->remote_port);
+    conn->data->state.proto.generic = prot_save;
+    if(CURLE_OK != result)
+      return result;
+#else
+    return CURLE_NOT_BUILT_IN;
+#endif
+  }
+  /* no HTTP tunnel proxy, just return */
+  return CURLE_OK;
+}
+
 /*
 * Curl_proxyCONNECT() requires that we're connected to a HTTP proxy. This
 * function will issue the necessary commands to get a seamless tunnel through
@@ -83,10 +117,14 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
 #define SELECT_TIMEOUT 2
  int error = SELECT_OK;

+  if(conn->tunnel_state[sockindex] == TUNNEL_COMPLETE)
+    return CURLE_OK; /* CONNECT is already completed */
+
  conn->bits.proxy_connect_closed = FALSE;

  do {
-    if(!conn->bits.tunnel_connecting) { /* BEGIN CONNECT PHASE */
+    if(TUNNEL_INIT == conn->tunnel_state[sockindex]) {
+      /* BEGIN CONNECT PHASE */
      char *host_port;
      Curl_send_buffer *req_buffer;

@@ -116,18 +154,28 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
      /* Setup the proxy-authorization header, if any */
      result = Curl_http_output_auth(conn, "CONNECT", host_port, TRUE);

+      free(host_port);
+
      if(CURLE_OK == result) {
        char *host=(char *)"";
        const char *proxyconn="";
        const char *useragent="";
        const char *http = (conn->proxytype == CURLPROXY_HTTP_1_0) ?
          "1.0" : "1.1";
+        char *hostheader= /* host:port with IPv6 support */
+          aprintf("%s%s%s:%hu", conn->bits.ipv6_ip?"[":"",
+                  hostname, conn->bits.ipv6_ip?"]":"",
+                  remote_port);
+        if(!hostheader) {
+          free(req_buffer);
+          return CURLE_OUT_OF_MEMORY;
+        }

        if(!Curl_checkheaders(data, "Host:")) {
-          host = aprintf("Host: %s\r\n", host_port);
+          host = aprintf("Host: %s\r\n", hostheader);
          if(!host) {
+            free(hostheader);
            free(req_buffer);
-            free(host_port);
            return CURLE_OUT_OF_MEMORY;
          }
        }
@@ -138,24 +186,24 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
           data->set.str[STRING_USERAGENT])
          useragent = conn->allocptr.uagent;

-        /* Send the connect request to the proxy */
-        /* BLOCKING */
        result =
          Curl_add_bufferf(req_buffer,
-                      "CONNECT %s:%hu HTTP/%s\r\n"
-                      "%s"  /* Host: */
-                      "%s"  /* Proxy-Authorization */
-                      "%s"  /* User-Agent */
-                      "%s", /* Proxy-Connection */
-                      hostname, remote_port, http,
-                      host,
-                      conn->allocptr.proxyuserpwd?
-                      conn->allocptr.proxyuserpwd:"",
-                      useragent,
-                      proxyconn);
+                           "CONNECT %s HTTP/%s\r\n"
+                           "%s"  /* Host: */
+                           "%s"  /* Proxy-Authorization */
+                           "%s"  /* User-Agent */
+                           "%s", /* Proxy-Connection */
+                           hostheader,
+                           http,
+                           host,
+                           conn->allocptr.proxyuserpwd?
+                           conn->allocptr.proxyuserpwd:"",
+                           useragent,
+                           proxyconn);

        if(host && *host)
          free(host);
+        free(hostheader);

        if(CURLE_OK == result)
          result = Curl_add_custom_headers(conn, req_buffer);
@@ -165,7 +213,8 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
          result = Curl_add_bufferf(req_buffer, "\r\n");

        if(CURLE_OK == result) {
-          /* Now send off the request */
+          /* Send the connect request to the proxy */
+          /* BLOCKING */
          result =
            Curl_add_buffer_send(req_buffer, conn,
                                 &data->info.request_size, 0, sockindex);
@@ -174,12 +223,12 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
        if(result)
          failf(data, "Failed sending CONNECT to proxy");
      }
-      free(host_port);
+
      Curl_safefree(req_buffer);
      if(result)
        return result;

-      conn->bits.tunnel_connecting = TRUE;
+      conn->tunnel_state[sockindex] = TUNNEL_CONNECT;
    } /* END CONNECT PHASE */

    /* now we've issued the CONNECT and we're waiting to hear back -
@@ -215,7 +264,6 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
       2) we're in multi-mode and we didn't block - it's either an error or we
       now have some data waiting.
       In any case, the tunnel_connecting phase is over. */
-    conn->bits.tunnel_connecting = FALSE;

    { /* BEGIN NEGOTIATION PHASE */
      size_t nread;   /* total size read */
@@ -505,9 +553,14 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
    if(closeConnection && data->req.newurl)
      conn->bits.proxy_connect_closed = TRUE;

+    /* to back to init state */
+    conn->tunnel_state[sockindex] = TUNNEL_INIT;
+
    return CURLE_RECV_ERROR;
  }

+  conn->tunnel_state[sockindex] = TUNNEL_COMPLETE;
+
  /* If a proxy-authorization header was used for the proxy, then we should
     make sure that it isn't accidentally used for the document request
     after we've connected. So let's free and clear it here. */
--- a/lib/http_proxy.h
+++ b/lib/http_proxy.h
@@ -7,7 +7,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -21,6 +21,7 @@
 * KIND, either express or implied.
 *
 ***************************************************************************/
+
 #if !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
 /* ftp can use this as well */
 CURLcode Curl_proxyCONNECT(struct connectdata *conn,
@@ -30,8 +31,11 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
 /* Default proxy timeout in milliseconds */
 #define PROXY_TIMEOUT (3600*1000)

+CURLcode Curl_proxy_connect(struct connectdata *conn);
+
 #else
 #define Curl_proxyCONNECT(x,y,z,w) CURLE_NOT_BUILT_IN
+#define Curl_proxy_connect(x) CURLE_OK
 #endif

 #endif /* HEADER_CURL_HTTP_PROXY_H */
--- a/lib/imap.c
+++ b/lib/imap.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -78,7 +78,6 @@
 #include "url.h"
 #include "rawstr.h"
 #include "strtoofft.h"
-#include "http_proxy.h"

 #define _MPRINTF_REPLACE /* use our functions only */
 #include <curl/mprintf.h>
@@ -344,6 +343,36 @@ static void imap_to_imaps(struct connectdata *conn)
 #define imap_to_imaps(x) Curl_nop_stmt
 #endif

+/* for the initial server greeting */
+static CURLcode imap_state_servergreet_resp(struct connectdata *conn,
+                                            int imapcode,
+                                            imapstate instate)
+{
+  CURLcode result = CURLE_OK;
+  struct SessionHandle *data = conn->data;
+
+  (void)instate; /* no use for this yet */
+
+  if(imapcode != 'O') {
+    failf(data, "Got unexpected imap-server response");
+    return CURLE_FTP_WEIRD_SERVER_REPLY;
+  }
+
+  if(data->set.use_ssl && !conn->ssl[FIRSTSOCKET].use) {
+    /* We don't have a SSL/TLS connection yet, but SSL is requested. Switch
+       to TLS connection now */
+    const char *str;
+
+    str = getcmdid(conn);
+    result = imapsendf(conn, str, "%s STARTTLS", str);
+    state(conn, IMAP_STARTTLS);
+  }
+  else
+    result = imap_state_login(conn);
+
+  return result;
+}
+
 /* for STARTTLS responses */
 static CURLcode imap_state_starttls_resp(struct connectdata *conn,
                                         int imapcode,
@@ -374,7 +403,9 @@ static CURLcode imap_state_starttls_resp(struct connectdata *conn,
      }
    }
  }
+
  state(conn, IMAP_STOP);
+
  return result;
 }

@@ -401,6 +432,7 @@ static CURLcode imap_state_login_resp(struct connectdata *conn,
 {
  CURLcode result = CURLE_OK;
  struct SessionHandle *data = conn->data;
+
  (void)instate; /* no use for this yet */

  if(imapcode != 'O') {
@@ -409,6 +441,7 @@ static CURLcode imap_state_login_resp(struct connectdata *conn,
  }

  state(conn, IMAP_STOP);
+
  return result;
 }

@@ -423,6 +456,7 @@ static CURLcode imap_state_fetch_resp(struct connectdata *conn,
  struct FTP *imap = data->state.proto.imap;
  struct pingpong *pp = &imapc->pp;
  const char *ptr = data->state.buffer;
+
  (void)instate; /* no use for this yet */

  if('*' != imapcode) {
@@ -490,6 +524,7 @@ static CURLcode imap_state_fetch_resp(struct connectdata *conn,
    result = CURLE_FTP_WEIRD_SERVER_REPLY; /* TODO: fix this code */

  state(conn, IMAP_STOP);
+
  return result;
 }

@@ -559,7 +594,6 @@ static CURLcode imap_statemach_act(struct connectdata *conn)
 {
  CURLcode result;
  curl_socket_t sock = conn->sock[FIRSTSOCKET];
-  struct SessionHandle *data=conn->data;
  int imapcode;
  struct imap_conn *imapc = &conn->proto.imapc;
  struct pingpong *pp = &imapc->pp;
@@ -581,24 +615,7 @@ static CURLcode imap_statemach_act(struct connectdata *conn)
  /* we have now received a full IMAP server response */
  switch(imapc->state) {
  case IMAP_SERVERGREET:
-    if(imapcode != 'O') {
-      failf(data, "Got unexpected imap-server response");
-      return CURLE_FTP_WEIRD_SERVER_REPLY;
-    }
-
-    if(data->set.use_ssl && !conn->ssl[FIRSTSOCKET].use) {
-      /* We don't have a SSL/TLS connection yet, but SSL is requested. Switch
-         to TLS connection now */
-      const char *str;
-
-      str = getcmdid(conn);
-      result = imapsendf(conn, str, "%s STARTTLS", str);
-      state(conn, IMAP_STARTTLS);
-    }
-    else
-      result = imap_state_login(conn);
-    if(result)
-      return result;
+    result = imap_state_servergreet_resp(conn, imapcode, imapc->state);
    break;

  case IMAP_LOGIN:
@@ -721,33 +738,6 @@ static CURLcode imap_connect(struct connectdata *conn,
  pp->endofresp = imap_endofresp;
  pp->conn = conn;

-  if(conn->bits.tunnel_proxy && conn->bits.httpproxy) {
-    /* for IMAP over HTTP proxy */
-    struct HTTP http_proxy;
-    struct FTP *imap_save;
-
-    /* BLOCKING */
-    /* We want "seamless" IMAP operations through HTTP proxy tunnel */
-
-    /* Curl_proxyCONNECT is based on a pointer to a struct HTTP at the member
-     * conn->proto.http; we want IMAP through HTTP and we have to change the
-     * member temporarily for connecting to the HTTP proxy. After
-     * Curl_proxyCONNECT we have to set back the member to the original struct
-     * IMAP pointer
-     */
-    imap_save = data->state.proto.imap;
-    memset(&http_proxy, 0, sizeof(http_proxy));
-    data->state.proto.http = &http_proxy;
-
-    result = Curl_proxyCONNECT(conn, FIRSTSOCKET,
-                               conn->host.name, conn->remote_port);
-
-    data->state.proto.imap = imap_save;
-
-    if(CURLE_OK != result)
-      return result;
-  }
-
  if((conn->handler->flags & PROTOPT_SSL) &&
     data->state.used_interface != Curl_if_multi) {
    /* BLOCKING */
--- a/lib/libcurl.imp
+++ b/lib/libcurl.imp
@@ -27,6 +27,7 @@
 	curl_mprintf,
 	curl_msprintf,
 	curl_msnprintf,
+	curl_mvaprintf,
 	curl_mvfprintf,
 	curl_mvsnprintf,
 	curl_strequal,
--- a/lib/makefile.amiga
+++ b/lib/makefile.amiga
@@ -11,7 +11,6 @@ CC	=	m68k-amigaos-gcc
 CFLAGS	=	-I$(ATCPSDKI) -m68020-60 -O2 -msoft-float -noixemul -g -I. -I../include -W -Wall

 include Makefile.inc
-CSOURCES += amigaos.c
 OBJS = $(CSOURCES:.c=.o)

 all:	$(OBJS)
--- a/lib/md4.c
+++ b/lib/md4.c
@@ -27,6 +27,7 @@
 #ifdef USE_NSS

 #include "curl_md4.h"
+#include "warnless.h"

 typedef unsigned int UINT4;

@@ -275,7 +276,7 @@ void Curl_md4it(unsigned char *output, const unsigned char *input, size_t len)
 {
  MD4_CTX ctx;
  MD4Init(&ctx);
-  MD4Update(&ctx, input, (unsigned int)len);
+  MD4Update(&ctx, input, curlx_uztoui(len));
  MD4Final(output, &ctx);
 }
 #endif /* USE_NSS */
--- a/lib/md5.c
+++ b/lib/md5.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -26,6 +26,7 @@

 #include "curl_md5.h"
 #include "curl_hmac.h"
+#include "warnless.h"

 #ifdef USE_GNUTLS_NETTLE

@@ -406,14 +407,66 @@ const HMAC_params Curl_HMAC_MD5[] = {
  }
 };

+const MD5_params Curl_DIGEST_MD5[] = {
+  {
+    (Curl_MD5_init_func) MD5_Init,      /* Digest initialization function */
+    (Curl_MD5_update_func) MD5_Update,  /* Digest update function */
+    (Curl_MD5_final_func) MD5_Final,    /* Digest computation end function */
+    sizeof(MD5_CTX),                    /* Size of digest context struct */
+    16                                  /* Result size */
+  }
+};

 void Curl_md5it(unsigned char *outbuffer, /* 16 bytes */
                const unsigned char *input)
 {
  MD5_CTX ctx;
  MD5_Init(&ctx);
-  MD5_Update(&ctx, input, (unsigned int)strlen((char *)input));
+  MD5_Update(&ctx, input, curlx_uztoui(strlen((char *)input)));
  MD5_Final(outbuffer, &ctx);
 }

+MD5_context *Curl_MD5_init(const MD5_params *md5params)
+{
+  MD5_context *ctxt;
+
+  /* Create MD5 context */
+  ctxt = malloc(sizeof *ctxt);
+
+  if(!ctxt)
+    return ctxt;
+
+  ctxt->md5_hashctx = malloc(md5params->md5_ctxtsize);
+
+  if(!ctxt->md5_hashctx) {
+    free(ctxt);
+    return NULL;
+  }
+
+  ctxt->md5_hash = md5params;
+
+  (*md5params->md5_init_func)(ctxt->md5_hashctx);
+
+  return ctxt;
+}
+
+int Curl_MD5_update(MD5_context *context,
+                    const unsigned char *data,
+                    unsigned int len)
+{
+  (*context->md5_hash->md5_update_func)(context->md5_hashctx, data, len);
+
+  return 0;
+}
+
+int Curl_MD5_final(MD5_context *context, unsigned char *result)
+{
+  (*context->md5_hash->md5_final_func)(result, context->md5_hashctx);
+
+  free(context->md5_hashctx);
+  free(context);
+
+  return 0;
+}
+
 #endif /* CURL_DISABLE_CRYPTO_AUTH */
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -812,7 +812,7 @@ static int waitconnect_getsock(struct connectdata *conn,

  /* when we've sent a CONNECT to a proxy, we should rather wait for the
     socket to become readable to be able to get the response headers */
-  if(conn->bits.tunnel_connecting)
+  if(conn->tunnel_state[FIRSTSOCKET] == TUNNEL_CONNECT)
    return GETSOCK_READSOCK(0);

  return GETSOCK_WRITESOCK(0);
@@ -1066,7 +1066,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
                         CURLM_STATE_WAITDO:CURLM_STATE_DO);
            else {
 #ifndef CURL_DISABLE_HTTP
-              if(easy->easy_conn->bits.tunnel_connecting)
+              if(easy->easy_conn->tunnel_state[FIRSTSOCKET] == TUNNEL_CONNECT)
                multistate(easy, CURLM_STATE_WAITPROXYCONNECT);
              else
 #endif
@@ -1111,7 +1111,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
                       CURLM_STATE_WAITDO:CURLM_STATE_DO);
          else {
 #ifndef CURL_DISABLE_HTTP
-            if(easy->easy_conn->bits.tunnel_connecting)
+            if(easy->easy_conn->tunnel_state[FIRSTSOCKET] == TUNNEL_CONNECT)
              multistate(easy, CURLM_STATE_WAITPROXYCONNECT);
            else
 #endif
@@ -1144,7 +1144,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
        multistate(easy, CURLM_STATE_CONNECT);
      }
      else if(CURLE_OK == easy->result) {
-        if(!easy->easy_conn->bits.tunnel_connecting)
+        if(easy->easy_conn->tunnel_state[FIRSTSOCKET] == TUNNEL_COMPLETE)
          multistate(easy, CURLM_STATE_WAITCONNECT);
      }
      break;
@@ -1179,7 +1179,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
             BUT if we are using a proxy we must change to WAITPROXYCONNECT
          */
 #ifndef CURL_DISABLE_HTTP
-          if(easy->easy_conn->bits.tunnel_connecting)
+          if(easy->easy_conn->tunnel_state[FIRSTSOCKET] == TUNNEL_CONNECT)
            multistate(easy, CURLM_STATE_WAITPROXYCONNECT);
          else
 #endif
--- a/lib/nonblock.c
+++ b/lib/nonblock.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2009, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -61,11 +61,11 @@ int curlx_nonblock(curl_socket_t sockfd,    /* operate on this */

  /* most recent unix versions */
  int flags;
-  flags = fcntl(sockfd, F_GETFL, 0);
+  flags = sfcntl(sockfd, F_GETFL, 0);
  if(nonblock)
-    return fcntl(sockfd, F_SETFL, flags | O_NONBLOCK);
+    return sfcntl(sockfd, F_SETFL, flags | O_NONBLOCK);
  else
-    return fcntl(sockfd, F_SETFL, flags & (~O_NONBLOCK));
+    return sfcntl(sockfd, F_SETFL, flags & (~O_NONBLOCK));

 #elif defined(HAVE_IOCTL_FIONBIO)

--- a/lib/nss.c
+++ b/lib/nss.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -62,6 +62,7 @@
 #include <certdb.h>
 #include <base64.h>
 #include <cert.h>
+#include <prerror.h>

 #include "curl_memory.h"
 #include "rawstr.h"
@@ -78,6 +79,9 @@ PRFileDesc *PR_ImportTCPSocket(PRInt32 osfd);

 PRLock * nss_initlock = NULL;
 PRLock * nss_crllock = NULL;
+#ifdef HAVE_NSS_INITCONTEXT
+NSSInitContext * nss_context = NULL;
+#endif

 volatile int initialized = 0;

@@ -170,11 +174,18 @@ static const int enable_ciphers_by_default[] = {
  SSL_NULL_WITH_NULL_NULL
 };

-#ifdef HAVE_PK11_CREATEGENERICOBJECT
 static const char* pem_library = "libnsspem.so";
-#endif
 SECMODModule* mod = NULL;

+static const char* nss_error_to_name(PRErrorCode code)
+{
+  const char *name = PR_ErrorToName(code);
+  if(name)
+    return name;
+
+  return "unknown error";
+}
+
 static SECStatus set_ciphers(struct SessionHandle *data, PRFileDesc * model,
                             char *cipher_list)
 {
@@ -305,7 +316,6 @@ static char* dup_nickname(struct SessionHandle *data, enum dupstring cert_kind)
  return NULL;
 }

-#ifdef HAVE_PK11_CREATEGENERICOBJECT
 /* Call PK11_CreateGenericObject() with the given obj_class and filename.  If
 * the call succeeds, append the object handle to the list of objects so that
 * the object can be destroyed in Curl_nss_close(). */
@@ -369,7 +379,6 @@ static void nss_destroy_object(void *user, void *ptr)
  (void) user;
  PK11_DestroyGenericObject(obj);
 }
-#endif

 static CURLcode nss_load_cert(struct ssl_connect_data *ssl,
                              const char *filename, PRBool cacert)
@@ -378,7 +387,6 @@ static CURLcode nss_load_cert(struct ssl_connect_data *ssl,
    ? CURLE_SSL_CACERT_BADFILE
    : CURLE_SSL_CERTPROBLEM;

-#ifdef HAVE_PK11_CREATEGENERICOBJECT
  /* libnsspem.so leaks memory if the requested file does not exist.  For more
   * details, go to <https://bugzilla.redhat.com/734760>. */
  if(is_file(filename))
@@ -405,7 +413,6 @@ static CURLcode nss_load_cert(struct ssl_connect_data *ssl,
      free(nickname);
    }
  }
-#endif

  return err;
 }
@@ -499,12 +506,13 @@ fail:
 static CURLcode nss_load_key(struct connectdata *conn, int sockindex,
                             char *key_file)
 {
-#ifdef HAVE_PK11_CREATEGENERICOBJECT
  PK11SlotInfo *slot;
  SECStatus status;
+  CURLcode rv;
  struct ssl_connect_data *ssl = conn->ssl;
+  (void)sockindex; /* unused */

-  CURLcode rv = nss_create_object(ssl, CKO_PRIVATE_KEY, key_file, FALSE);
+  rv = nss_create_object(ssl, CKO_PRIVATE_KEY, key_file, FALSE);
  if(CURLE_OK != rv) {
    PR_SetError(SEC_ERROR_BAD_KEY, 0);
    return rv;
@@ -524,15 +532,6 @@ static CURLcode nss_load_key(struct connectdata *conn, int sockindex,
  return (SECSuccess == status)
    ? CURLE_OK
    : CURLE_SSL_CERTPROBLEM;
-#else
-  /* If we don't have PK11_CreateGenericObject then we can't load a file-based
-   * key.
-   */
-  (void)conn; /* unused */
-  (void)key_file; /* unused */
-  return CURLE_SSL_CERTPROBLEM;
-#endif
-  (void)sockindex; /* unused */
 }

 static int display_error(struct connectdata *conn, PRInt32 err,
@@ -560,8 +559,11 @@ static CURLcode cert_stuff(struct connectdata *conn, int sockindex,
  if(cert_file) {
    rv = nss_load_cert(&conn->ssl[sockindex], cert_file, PR_FALSE);
    if(CURLE_OK != rv) {
-      if(!display_error(conn, PR_GetError(), cert_file))
-        failf(data, "Unable to load client cert %d.", PR_GetError());
+      const PRErrorCode err = PR_GetError();
+      if(!display_error(conn, err, cert_file)) {
+        const char *err_name = nss_error_to_name(err);
+        failf(data, "unable to load client cert: %d (%s)", err, err_name);
+      }

      return rv;
    }
@@ -574,8 +576,11 @@ static CURLcode cert_stuff(struct connectdata *conn, int sockindex,
      /* In case the cert file also has the key */
      rv = nss_load_key(conn, sockindex, cert_file);
    if(CURLE_OK != rv) {
-      if(!display_error(conn, PR_GetError(), key_file))
-        failf(data, "Unable to load client key %d.", PR_GetError());
+      const PRErrorCode err = PR_GetError();
+      if(!display_error(conn, err, key_file)) {
+        const char *err_name = nss_error_to_name(err);
+        failf(data, "unable to load client key: %d (%s)", err, err_name);
+      }

      return rv;
    }
@@ -775,7 +780,6 @@ static SECStatus SelectClientCert(void *arg, PRFileDesc *sock,
  struct SessionHandle *data = connssl->data;
  const char *nickname = connssl->client_nickname;

-#ifdef HAVE_PK11_CREATEGENERICOBJECT
  if(connssl->obj_clicert) {
    /* use the cert/key provided by PEM reader */
    static const char pem_slotname[] = "PEM Token #1";
@@ -815,7 +819,6 @@ static SECStatus SelectClientCert(void *arg, PRFileDesc *sock,
    display_cert_info(data, *pRetCert);
    return SECSuccess;
  }
-#endif

  /* use the default NSS hook */
  if(SECSuccess != NSS_GetClientAuthData((void *)nickname, sock, caNames,
@@ -878,29 +881,57 @@ isTLSIntoleranceError(PRInt32 err)

 static CURLcode nss_init_core(struct SessionHandle *data, const char *cert_dir)
 {
-  if(NSS_IsInitialized())
+#ifdef HAVE_NSS_INITCONTEXT
+  NSSInitParameters initparams;
+
+  if(nss_context != NULL)
    return CURLE_OK;

+  memset((void *) &initparams, '\0', sizeof(initparams));
+  initparams.length = sizeof(initparams);
+#else /* HAVE_NSS_INITCONTEXT */
+  SECStatus rv;
+
+  if(NSS_IsInitialized())
+    return CURLE_OK;
+#endif
+
  if(cert_dir) {
-    SECStatus rv;
    const bool use_sql = NSS_VersionCheck("3.12.0");
    char *certpath = aprintf("%s%s", use_sql ? "sql:" : "", cert_dir);
    if(!certpath)
      return CURLE_OUT_OF_MEMORY;

    infof(data, "Initializing NSS with certpath: %s\n", certpath);
+#ifdef HAVE_NSS_INITCONTEXT
+    nss_context = NSS_InitContext(certpath, "", "", "", &initparams,
+            NSS_INIT_READONLY | NSS_INIT_PK11RELOAD);
+    free(certpath);
+
+    if(nss_context != NULL)
+      return CURLE_OK;
+#else /* HAVE_NSS_INITCONTEXT */
    rv = NSS_Initialize(certpath, "", "", "", NSS_INIT_READONLY);
    free(certpath);

    if(rv == SECSuccess)
      return CURLE_OK;
+#endif

    infof(data, "Unable to initialize NSS database\n");
  }

  infof(data, "Initializing NSS with certpath: none\n");
+#ifdef HAVE_NSS_INITCONTEXT
+  nss_context = NSS_InitContext("", "", "", "", &initparams, NSS_INIT_READONLY
+         | NSS_INIT_NOCERTDB   | NSS_INIT_NOMODDB       | NSS_INIT_FORCEOPEN
+         | NSS_INIT_NOROOTINIT | NSS_INIT_OPTIMIZESPACE | NSS_INIT_PK11RELOAD);
+  if(nss_context != NULL)
+    return CURLE_OK;
+#else /* HAVE_NSS_INITCONTEXT */
  if(NSS_NoDB_Init(NULL) == SECSuccess)
    return CURLE_OK;
+#endif

  infof(data, "Unable to initialize NSS\n");
  return CURLE_SSL_CACERT_BADFILE;
@@ -996,7 +1027,12 @@ void Curl_nss_cleanup(void)
      SECMOD_DestroyModule(mod);
      mod = NULL;
    }
+#ifdef HAVE_NSS_INITCONTEXT
+    NSS_ShutdownContext(nss_context);
+    nss_context = NULL;
+#else /* HAVE_NSS_INITCONTEXT */
    NSS_Shutdown();
+#endif
  }
  PR_Unlock(nss_initlock);

@@ -1053,12 +1089,11 @@ void Curl_nss_close(struct connectdata *conn, int sockindex)
       * next time to the same server */
      SSL_InvalidateSession(connssl->handle);
    }
-#ifdef HAVE_PK11_CREATEGENERICOBJECT
    /* destroy all NSS objects in order to avoid failure of NSS shutdown */
    Curl_llist_destroy(connssl->obj_list, NULL);
    connssl->obj_list = NULL;
    connssl->obj_clicert = NULL;
-#endif
+
    PR_Close(connssl->handle);
    connssl->handle = NULL;
  }
@@ -1158,6 +1193,7 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex)
  PRBool ssl3 = PR_FALSE;
  PRBool tlsv1 = PR_FALSE;
  PRBool ssl_no_cache;
+  PRBool ssl_cbc_random_iv;
  struct SessionHandle *data = conn->data;
  curl_socket_t sockfd = conn->sock[sockindex];
  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
@@ -1172,12 +1208,10 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex)

  connssl->data = data;

-#ifdef HAVE_PK11_CREATEGENERICOBJECT
  /* list of all NSS objects we need to destroy in Curl_nss_close() */
  connssl->obj_list = Curl_llist_alloc(nss_destroy_object);
  if(!connssl->obj_list)
    return CURLE_OUT_OF_MEMORY;
-#endif

  /* FIXME. NSS doesn't support multiple databases open at the same time. */
  PR_Lock(nss_initlock);
@@ -1189,7 +1223,6 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex)

  curlerr = CURLE_SSL_CONNECT_ERROR;

-#ifdef HAVE_PK11_CREATEGENERICOBJECT
  if(!mod) {
    char *configstring = aprintf("library=%s name=PEM", pem_library);
    if(!configstring) {
@@ -1208,7 +1241,6 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex)
            "OpenSSL PEM certificates will not work.\n", pem_library);
    }
  }
-#endif

  PK11_SetPasswordFunc(nss_get_password);
  PR_Unlock(nss_initlock);
@@ -1266,6 +1298,18 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex)
  if(SSL_OptionSet(model, SSL_V2_COMPATIBLE_HELLO, ssl2) != SECSuccess)
    goto error;

+  ssl_cbc_random_iv = !data->set.ssl_enable_beast;
+#ifdef SSL_CBC_RANDOM_IV
+  /* unless the user explicitly asks to allow the protocol vulnerability, we
+     use the work-around */
+  if(SSL_OptionSet(model, SSL_CBC_RANDOM_IV, ssl_cbc_random_iv) != SECSuccess)
+    infof(data, "warning: failed to set SSL_CBC_RANDOM_IV = %d\n",
+          ssl_cbc_random_iv);
+#else
+  if(ssl_cbc_random_iv)
+    infof(data, "warning: support for SSL_CBC_RANDOM_IV not compiled in\n");
+#endif
+
  /* reset the flag to avoid an infinite loop */
  data->state.ssl_connect_retry = FALSE;

@@ -1327,9 +1371,7 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex)
    char *nickname = dup_nickname(data, STRING_CERT);
    if(nickname) {
      /* we are not going to use libnsspem.so to read the client cert */
-#ifdef HAVE_PK11_CREATEGENERICOBJECT
      connssl->obj_clicert = NULL;
-#endif
    }
    else {
      CURLcode rv = cert_stuff(conn, sockindex, data->set.str[STRING_CERT],
@@ -1424,16 +1466,14 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex)
  if(handle_cc_error(err, data))
    curlerr = CURLE_SSL_CERTPROBLEM;
  else
-    infof(data, "NSS error %d\n", err);
+    infof(data, "NSS error %d (%s)\n", err, nss_error_to_name(err));

  if(model)
    PR_Close(model);

-#ifdef HAVE_PK11_CREATEGENERICOBJECT
    /* cleanup on connection failure */
    Curl_llist_destroy(connssl->obj_list, NULL);
    connssl->obj_list = NULL;
-#endif

  if(ssl3 && tlsv1 && isTLSIntoleranceError(err)) {
    /* schedule reconnect through Curl_retry_request() */
@@ -1462,7 +1502,8 @@ static ssize_t nss_send(struct connectdata *conn,  /* connection data */
    else if(handle_cc_error(err, conn->data))
      *curlcode = CURLE_SSL_CERTPROBLEM;
    else {
-      failf(conn->data, "SSL write: error %d", err);
+      const char *err_name = nss_error_to_name(err);
+      failf(conn->data, "SSL write: error %d (%s)", err, err_name);
      *curlcode = CURLE_SEND_ERROR;
    }
    return -1;
@@ -1488,7 +1529,8 @@ static ssize_t nss_recv(struct connectdata * conn, /* connection data */
    else if(handle_cc_error(err, conn->data))
      *curlcode = CURLE_SSL_CERTPROBLEM;
    else {
-      failf(conn->data, "SSL read: errno %d", err);
+      const char *err_name = nss_error_to_name(err);
+      failf(conn->data, "SSL read: errno %d (%s)", err, err_name);
      *curlcode = CURLE_RECV_ERROR;
    }
    return -1;
--- a/lib/openldap.c
+++ b/lib/openldap.c
@@ -46,7 +46,6 @@
 #include "curl_ldap.h"
 #include "curl_memory.h"
 #include "curl_base64.h"
-#include "http_proxy.h"

 #define _MPRINTF_REPLACE /* use our functions only */
 #include <curl/mprintf.h>
@@ -208,33 +207,6 @@ static CURLcode ldap_connect(struct connectdata *conn, bool *done)

  ldap_set_option(li->ld, LDAP_OPT_PROTOCOL_VERSION, &proto);

-  if(conn->bits.tunnel_proxy && conn->bits.httpproxy) {
-    /* for LDAP over HTTP proxy */
-    struct HTTP http_proxy;
-    ldapconninfo *li_save;
-    CURLcode result;
-
-    /* BLOCKING */
-    /* We want "seamless" LDAP operations through HTTP proxy tunnel */
-
-    /* Curl_proxyCONNECT is based on a pointer to a struct HTTP at the member
-     * conn->proto.http; we want LDAP through HTTP and we have to change the
-     * member temporarily for connecting to the HTTP proxy. After
-     * Curl_proxyCONNECT we have to set back the member to the original struct
-     * LDAP pointer
-     */
-    li_save = data->state.proto.generic;
-    memset(&http_proxy, 0, sizeof(http_proxy));
-    data->state.proto.http = &http_proxy;
-    result = Curl_proxyCONNECT(conn, FIRSTSOCKET,
-                               conn->host.name, conn->remote_port);
-
-    data->state.proto.generic = li_save;
-
-    if(CURLE_OK != result)
-      return result;
-  }
-
 #ifdef USE_SSL
  if(conn->handler->flags & PROTOPT_SSL) {
    CURLcode res;
--- a/lib/parsedate.c
+++ b/lib/parsedate.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -75,6 +75,10 @@

 #include "setup.h"

+#ifdef HAVE_LIMITS_H
+#include <limits.h>
+#endif
+
 #include <curl/curl.h>
 #include "rawstr.h"
 #include "warnless.h"
@@ -392,7 +396,24 @@ static int parsedate(const char *date, time_t *output)
        secnum = 0;
      }
      else {
-        val = curlx_sltosi(strtol(date, &end, 10));
+        long lval;
+        int error;
+        int old_errno;
+
+        old_errno = ERRNO;
+        SET_ERRNO(0);
+        lval = strtol(date, &end, 10);
+        error = ERRNO;
+        if(error != old_errno)
+          SET_ERRNO(old_errno);
+
+        if(error)
+          return PARSEDATE_FAIL;
+
+        if((lval > (long)INT_MAX) || (lval < (long)INT_MIN))
+          return PARSEDATE_FAIL;
+
+        val = curlx_sltosi(lval);

        if((tzoff == -1) &&
           ((end - date) == 4) &&
--- a/lib/polarssl.c
+++ b/lib/polarssl.c
@@ -41,6 +41,9 @@
 #include <polarssl/x509.h>
 #include <polarssl/version.h>

+#include <polarssl/entropy.h>
+#include <polarssl/ctr_drbg.h>
+
 #if POLARSSL_VERSION_NUMBER<0x01000000
 /*
  Earlier versions of polarssl had no WANT_READ or WANT_WRITE, only TRY_AGAIN
@@ -95,15 +98,14 @@ static void polarssl_debug(void *context, int level, char *line)
 static Curl_recv polarssl_recv;
 static Curl_send polarssl_send;

-/*
- * This function loads all the client/CA certificates and CRLs. Setup the TLS
- * layer and do all necessary magic.
- */
-CURLcode
-Curl_polarssl_connect(struct connectdata *conn,
-                      int sockindex)
+
+static CURLcode
+polarssl_connect_step1(struct connectdata *conn,
+                     int sockindex)
 {
  struct SessionHandle *data = conn->data;
+  struct ssl_connect_data* connssl = &conn->ssl[sockindex];
+
  bool sni = TRUE; /* default is SNI enabled */
  int ret = -1;
 #ifdef ENABLE_IPV6
@@ -113,10 +115,6 @@ Curl_polarssl_connect(struct connectdata *conn,
 #endif
  void *old_session = NULL;
  size_t old_session_size = 0;
-  char buffer[1024];
-
-  if(conn->ssl[sockindex].state == ssl_connection_complete)
-    return CURLE_OK;

  /* PolarSSL only supports SSLv3 and TLSv1 */
  if(data->set.ssl.version == CURL_SSLVERSION_SSLv2) {
@@ -126,16 +124,16 @@ Curl_polarssl_connect(struct connectdata *conn,
  else if(data->set.ssl.version == CURL_SSLVERSION_SSLv3)
    sni = FALSE; /* SSLv3 has no SNI */

-  havege_init(&conn->ssl[sockindex].hs);
+  havege_init(&connssl->hs);

  /* Load the trusted CA */
-  memset(&conn->ssl[sockindex].cacert, 0, sizeof(x509_cert));
+  memset(&connssl->cacert, 0, sizeof(x509_cert));

  if(data->set.str[STRING_SSL_CAFILE]) {
-    ret = x509parse_crtfile(&conn->ssl[sockindex].cacert,
+    ret = x509parse_crtfile(&connssl->cacert,
                            data->set.str[STRING_SSL_CAFILE]);

-    if(ret) {
+    if(ret<0) {
      failf(data, "Error reading ca cert file %s: -0x%04X",
            data->set.str[STRING_SSL_CAFILE], ret);

@@ -145,10 +143,10 @@ Curl_polarssl_connect(struct connectdata *conn,
  }

  /* Load the client certificate */
-  memset(&conn->ssl[sockindex].clicert, 0, sizeof(x509_cert));
+  memset(&connssl->clicert, 0, sizeof(x509_cert));

  if(data->set.str[STRING_CERT]) {
-    ret = x509parse_crtfile(&conn->ssl[sockindex].clicert,
+    ret = x509parse_crtfile(&connssl->clicert,
                            data->set.str[STRING_CERT]);

    if(ret) {
@@ -160,7 +158,7 @@ Curl_polarssl_connect(struct connectdata *conn,

  /* Load the client private key */
  if(data->set.str[STRING_KEY]) {
-    ret = x509parse_keyfile(&conn->ssl[sockindex].rsa,
+    ret = x509parse_keyfile(&connssl->rsa,
                            data->set.str[STRING_KEY],
                            data->set.str[STRING_KEY_PASSWD]);

@@ -172,10 +170,10 @@ Curl_polarssl_connect(struct connectdata *conn,
  }

  /* Load the CRL */
-  memset(&conn->ssl[sockindex].crl, 0, sizeof(x509_crl));
+  memset(&connssl->crl, 0, sizeof(x509_crl));

  if(data->set.str[STRING_SSL_CRLFILE]) {
-    ret = x509parse_crlfile(&conn->ssl[sockindex].crl,
+    ret = x509parse_crlfile(&connssl->crl,
                            data->set.str[STRING_SSL_CRLFILE]);

    if(ret) {
@@ -185,64 +183,77 @@ Curl_polarssl_connect(struct connectdata *conn,
    }
  }

-  infof(data, "PolarSSL: Connected to %s:%d\n",
+  infof(data, "PolarSSL: Connecting to %s:%d\n",
        conn->host.name, conn->remote_port);

-  havege_init(&conn->ssl[sockindex].hs);
-
-  if(ssl_init(&conn->ssl[sockindex].ssl)) {
+  if(ssl_init(&connssl->ssl)) {
    failf(data, "PolarSSL: ssl_init failed");
    return CURLE_SSL_CONNECT_ERROR;
  }

-  ssl_set_endpoint(&conn->ssl[sockindex].ssl, SSL_IS_CLIENT);
-  ssl_set_authmode(&conn->ssl[sockindex].ssl, SSL_VERIFY_OPTIONAL);
+  ssl_set_endpoint(&connssl->ssl, SSL_IS_CLIENT);
+  ssl_set_authmode(&connssl->ssl, SSL_VERIFY_OPTIONAL);

-  ssl_set_rng(&conn->ssl[sockindex].ssl, HAVEGE_RANDOM,
-              &conn->ssl[sockindex].hs);
-  ssl_set_bio(&conn->ssl[sockindex].ssl,
+  ssl_set_rng(&connssl->ssl, HAVEGE_RANDOM,
+              &connssl->hs);
+  ssl_set_bio(&connssl->ssl,
              net_recv, &conn->sock[sockindex],
              net_send, &conn->sock[sockindex]);


 #if POLARSSL_VERSION_NUMBER<0x01000000
-  ssl_set_ciphers(&conn->ssl[sockindex].ssl, ssl_default_ciphers);
+  ssl_set_ciphers(&connssl->ssl, ssl_default_ciphers);
 #else
-  ssl_set_ciphersuites(&conn->ssl[sockindex].ssl, ssl_default_ciphersuites);
+  ssl_set_ciphersuites(&connssl->ssl, ssl_default_ciphersuites);
 #endif
  if(!Curl_ssl_getsessionid(conn, &old_session, &old_session_size)) {
-    memcpy(&conn->ssl[sockindex].ssn, old_session, old_session_size);
+    memcpy(&connssl->ssn, old_session, old_session_size);
    infof(data, "PolarSSL re-using session\n");
  }

-  ssl_set_session(&conn->ssl[sockindex].ssl, 1, 600,
-                  &conn->ssl[sockindex].ssn);
+  ssl_set_session(&connssl->ssl, 1, 600,
+                  &connssl->ssn);

-  ssl_set_ca_chain(&conn->ssl[sockindex].ssl,
-                   &conn->ssl[sockindex].cacert,
-                   &conn->ssl[sockindex].crl,
+  ssl_set_ca_chain(&connssl->ssl,
+                   &connssl->cacert,
+                   &connssl->crl,
                   conn->host.name);

-  ssl_set_own_cert(&conn->ssl[sockindex].ssl,
-                   &conn->ssl[sockindex].clicert, &conn->ssl[sockindex].rsa);
+  ssl_set_own_cert(&connssl->ssl,
+                   &connssl->clicert, &connssl->rsa);

  if(!Curl_inet_pton(AF_INET, conn->host.name, &addr) &&
 #ifdef ENABLE_IPV6
     !Curl_inet_pton(AF_INET6, conn->host.name, &addr) &&
 #endif
-     sni && ssl_set_hostname(&conn->ssl[sockindex].ssl, conn->host.name)) {
+     sni && ssl_set_hostname(&connssl->ssl, conn->host.name)) {
     infof(data, "WARNING: failed to configure "
                 "server name indication (SNI) TLS extension\n");
  }

-  infof(data, "PolarSSL: performing SSL/TLS handshake...\n");
-
 #ifdef POLARSSL_DEBUG
-  ssl_set_dbg(&conn->ssl[sockindex].ssl, polarssl_debug, data);
+  ssl_set_dbg(&connssl->ssl, polarssl_debug, data);
 #endif

+  connssl->connecting_state = ssl_connect_2;
+
+  return CURLE_OK;
+}
+
+static CURLcode
+polarssl_connect_step2(struct connectdata *conn,
+                     int sockindex)
+{
+  int ret;
+  struct SessionHandle *data = conn->data;
+  struct ssl_connect_data* connssl = &conn->ssl[sockindex];
+  char buffer[1024];
+
+  conn->recv[sockindex] = polarssl_recv;
+  conn->send[sockindex] = polarssl_send;
+
  for(;;) {
-    if(!(ret = ssl_handshake(&conn->ssl[sockindex].ssl)))
+    if(!(ret = ssl_handshake(&connssl->ssl)))
      break;
    else if(ret != POLARSSL_ERR_NET_WANT_READ &&
            ret != POLARSSL_ERR_NET_WANT_WRITE) {
@@ -250,27 +261,17 @@ Curl_polarssl_connect(struct connectdata *conn,
      return CURLE_SSL_CONNECT_ERROR;
    }
    else {
-      /* wait for data from server... */
-      long timeout_ms = Curl_timeleft(data, NULL, TRUE);
-
-      if(timeout_ms < 0) {
-        failf(data, "SSL connection timeout");
-        return CURLE_OPERATION_TIMEDOUT;
+      if(ret == POLARSSL_ERR_NET_WANT_READ) {
+        connssl->connecting_state = ssl_connect_2_reading;
+        return CURLE_OK;
      }
-
-      switch(Curl_socket_ready(conn->sock[sockindex],
-                               CURL_SOCKET_BAD, timeout_ms)) {
-      case 0:
-        failf(data, "SSL handshake timeout");
-        return CURLE_OPERATION_TIMEDOUT;
-        break;
-      case CURL_CSELECT_IN:
-        continue;
-        break;
-      default:
-        return CURLE_SSL_CONNECT_ERROR;
-        break;
+      if(ret == POLARSSL_ERR_NET_WANT_WRITE) {
+        connssl->connecting_state = ssl_connect_2_writing;
+        return CURLE_OK;
      }
+      failf(data, "SSL_connect failed with error %d.", ret);
+      return CURLE_SSL_CONNECT_ERROR;
+
    }
  }

@@ -290,8 +291,10 @@ Curl_polarssl_connect(struct connectdata *conn,
    if(ret & BADCERT_EXPIRED)
      failf(data, "Cert verify failed: BADCERT_EXPIRED\n");

-    if(ret & BADCERT_REVOKED)
+    if(ret & BADCERT_REVOKED) {
      failf(data, "Cert verify failed: BADCERT_REVOKED");
+      return CURLE_SSL_CACERT;
+    }

    if(ret & BADCERT_CN_MISMATCH)
      failf(data, "Cert verify failed: BADCERT_CN_MISMATCH");
@@ -299,7 +302,7 @@ Curl_polarssl_connect(struct connectdata *conn,
    if(ret & BADCERT_NOT_TRUSTED)
      failf(data, "Cert verify failed: BADCERT_NOT_TRUSTED");

-    return CURLE_SSL_CACERT;
+    return CURLE_PEER_FAILED_VERIFICATION;
  }

  if(conn->ssl[sockindex].ssl.peer_cert) {
@@ -311,25 +314,55 @@ Curl_polarssl_connect(struct connectdata *conn,
      infof(data, "Dumping cert info:\n%s\n", buffer);
  }

-  conn->ssl[sockindex].state = ssl_connection_complete;
-  conn->recv[sockindex] = polarssl_recv;
-  conn->send[sockindex] = polarssl_send;
+  connssl->connecting_state = ssl_connect_3;
+  infof(data, "SSL connected\n");
+
+  return CURLE_OK;
+}
+
+static CURLcode
+polarssl_connect_step3(struct connectdata *conn,
+                     int sockindex)
+{
+  CURLcode retcode = CURLE_OK;
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
+  struct SessionHandle *data = conn->data;
+  void *old_ssl_sessionid = NULL;
+  ssl_session *our_ssl_sessionid = &conn->ssl[sockindex].ssn ;
+  int incache;
+
+  DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);

  /* Save the current session data for possible re-use */
-  {
-    void *new_session = malloc(sizeof(conn->ssl[sockindex].ssn));
-
-    if(new_session) {
-      memcpy(new_session, &conn->ssl[sockindex].ssn,
-             sizeof(conn->ssl[sockindex].ssn));
-
-      if(old_session)
-        Curl_ssl_delsessionid(conn, old_session);
-
-      return Curl_ssl_addsessionid(conn, new_session,
-                                   sizeof(conn->ssl[sockindex].ssn));
+  incache = !(Curl_ssl_getsessionid(conn, &old_ssl_sessionid, NULL));
+  if(incache) {
+    if(old_ssl_sessionid != our_ssl_sessionid) {
+      infof(data, "old SSL session ID is stale, removing\n");
+      Curl_ssl_delsessionid(conn, old_ssl_sessionid);
+      incache = FALSE;
    }
  }
+  if(!incache) {
+    void *new_session = malloc(sizeof(ssl_session));
+
+    if(new_session) {
+      memcpy(new_session, our_ssl_sessionid,
+             sizeof(ssl_session));
+
+      retcode = Curl_ssl_addsessionid(conn, new_session,
+                                   sizeof(ssl_session));
+    }
+    else {
+      retcode = CURLE_OUT_OF_MEMORY;
+    }
+
+    if(retcode) {
+      failf(data, "failed to store ssl session");
+      return retcode;
+    }
+  }
+
+  connssl->connecting_state = ssl_connect_done;

  return CURLE_OK;
 }
@@ -401,7 +434,146 @@ void Curl_polarssl_session_free(void *ptr)

 size_t Curl_polarssl_version(char *buffer, size_t size)
 {
-  return snprintf(buffer, size, "PolarSSL");
+  unsigned int version = version_get_number();
+  return snprintf(buffer, size, "PolarSSL/%d.%d.%d", version>>24,
+                  (version>>16)&0xff, (version>>8)&0xff);
+}
+
+static CURLcode
+polarssl_connect_common(struct connectdata *conn,
+                        int sockindex,
+                        bool nonblocking,
+                        bool *done)
+{
+  CURLcode retcode;
+  struct SessionHandle *data = conn->data;
+  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
+  curl_socket_t sockfd = conn->sock[sockindex];
+  long timeout_ms;
+  int what;
+
+  /* check if the connection has already been established */
+  if(ssl_connection_complete == connssl->state) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  if(ssl_connect_1==connssl->connecting_state) {
+    /* Find out how much more time we're allowed */
+    timeout_ms = Curl_timeleft(data, NULL, TRUE);
+
+    if(timeout_ms < 0) {
+      /* no need to continue if time already is up */
+      failf(data, "SSL connection timeout");
+      return CURLE_OPERATION_TIMEDOUT;
+    }
+    retcode = polarssl_connect_step1(conn, sockindex);
+    if(retcode)
+      return retcode;
+  }
+
+  while(ssl_connect_2 == connssl->connecting_state ||
+        ssl_connect_2_reading == connssl->connecting_state ||
+        ssl_connect_2_writing == connssl->connecting_state) {
+
+    /* check allowed time left */
+    timeout_ms = Curl_timeleft(data, NULL, TRUE);
+
+    if(timeout_ms < 0) {
+      /* no need to continue if time already is up */
+      failf(data, "SSL connection timeout");
+      return CURLE_OPERATION_TIMEDOUT;
+    }
+
+    /* if ssl is expecting something, check if it's available. */
+    if(connssl->connecting_state == ssl_connect_2_reading
+       || connssl->connecting_state == ssl_connect_2_writing) {
+
+      curl_socket_t writefd = ssl_connect_2_writing==
+        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
+      curl_socket_t readfd = ssl_connect_2_reading==
+        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
+
+      what = Curl_socket_ready(readfd, writefd, nonblocking?0:timeout_ms);
+      if(what < 0) {
+        /* fatal error */
+        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
+        return CURLE_SSL_CONNECT_ERROR;
+      }
+      else if(0 == what) {
+        if(nonblocking) {
+          *done = FALSE;
+          return CURLE_OK;
+        }
+        else {
+          /* timeout */
+          failf(data, "SSL connection timeout");
+          return CURLE_OPERATION_TIMEDOUT;
+        }
+      }
+      /* socket is readable or writable */
+    }
+
+    /* Run transaction, and return to the caller if it failed or if
+     * this connection is part of a multi handle and this loop would
+     * execute again. This permits the owner of a multi handle to
+     * abort a connection attempt before step2 has completed while
+     * ensuring that a client using select() or epoll() will always
+     * have a valid fdset to wait on.
+     */
+    retcode = polarssl_connect_step2(conn, sockindex);
+    if(retcode || (nonblocking &&
+                   (ssl_connect_2 == connssl->connecting_state ||
+                    ssl_connect_2_reading == connssl->connecting_state ||
+                    ssl_connect_2_writing == connssl->connecting_state)))
+      return retcode;
+
+  } /* repeat step2 until all transactions are done. */
+
+  if(ssl_connect_3==connssl->connecting_state) {
+    retcode = polarssl_connect_step3(conn, sockindex);
+    if(retcode)
+      return retcode;
+  }
+
+  if(ssl_connect_done==connssl->connecting_state) {
+    connssl->state = ssl_connection_complete;
+    conn->recv[sockindex] = polarssl_recv;
+    conn->send[sockindex] = polarssl_send;
+    *done = TRUE;
+  }
+  else
+    *done = FALSE;
+
+  /* Reset our connect state machine */
+  connssl->connecting_state = ssl_connect_1;
+
+  return CURLE_OK;
+}
+
+CURLcode
+Curl_polarssl_connect_nonblocking(struct connectdata *conn,
+                                int sockindex,
+                                bool *done)
+{
+  return polarssl_connect_common(conn, sockindex, TRUE, done);
+}
+
+
+CURLcode
+Curl_polarssl_connect(struct connectdata *conn,
+                    int sockindex)
+{
+  CURLcode retcode;
+  bool done = FALSE;
+
+  retcode = polarssl_connect_common(conn, sockindex, FALSE, &done);
+  if(retcode)
+    return retcode;
+
+  DEBUGASSERT(done);
+
+  return CURLE_OK;
 }

 #endif
--- a/lib/polarssl.h
+++ b/lib/polarssl.h
@@ -27,6 +27,10 @@

 CURLcode Curl_polarssl_connect(struct connectdata *conn, int sockindex);

+CURLcode Curl_polarssl_connect_nonblocking(struct connectdata *conn,
+                                           int sockindex,
+                                           bool *done);
+
 /* tell PolarSSL to close down all open information regarding connections (and
   thus session ID caching etc) */
 void Curl_polarssl_close_all(struct SessionHandle *data);
@@ -42,6 +46,7 @@ int Curl_polarssl_shutdown(struct connectdata *conn, int sockindex);
 #define curlssl_init() (1)
 #define curlssl_cleanup() Curl_nop_stmt
 #define curlssl_connect Curl_polarssl_connect
+#define curlssl_connect_nonblocking Curl_polarssl_connect_nonblocking
 #define curlssl_session_free(x)  Curl_polarssl_session_free(x)
 #define curlssl_close_all Curl_polarssl_close_all
 #define curlssl_close Curl_polarssl_close
--- a/lib/pop3.c
+++ b/lib/pop3.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -79,7 +79,6 @@
 #include "url.h"
 #include "rawstr.h"
 #include "strtoofft.h"
-#include "http_proxy.h"

 #define _MPRINTF_REPLACE /* use our functions only */
 #include <curl/mprintf.h>
@@ -90,6 +89,7 @@

 /* Local API functions */
 static CURLcode pop3_parse_url_path(struct connectdata *conn);
+static CURLcode pop3_parse_custom_request(struct connectdata *conn);
 static CURLcode pop3_regular_transfer(struct connectdata *conn, bool *done);
 static CURLcode pop3_do(struct connectdata *conn, bool *done);
 static CURLcode pop3_done(struct connectdata *conn,
@@ -128,7 +128,6 @@ const struct Curl_handler Curl_handler_pop3 = {
  PROTOPT_CLOSEACTION | PROTOPT_NOURLQUERY /* flags */
 };

-
 #ifdef USE_SSL
 /*
 * POP3S protocol handler.
@@ -181,7 +180,6 @@ static const struct Curl_handler Curl_handler_pop3_proxy = {
  PROTOPT_NONE                          /* flags */
 };

-
 #ifdef USE_SSL
 /*
 * HTTP-proxyed POP3S protocol handler.
@@ -209,7 +207,6 @@ static const struct Curl_handler Curl_handler_pop3s_proxy = {
 #endif
 #endif

-
 /* function that checks for a pop3 status code at the start of the given
   string */
 static int pop3_endofresp(struct pingpong *pp,
@@ -220,7 +217,7 @@ static int pop3_endofresp(struct pingpong *pp,

  if(((len >= 3) && !memcmp("+OK", line, 3)) ||
     ((len >= 4) && !memcmp("-ERR", line, 4))) {
-    *resp=line[1]; /* O or E */
+    *resp = line[1]; /* O or E */
    return TRUE;
  }

@@ -239,9 +236,7 @@ static void state(struct connectdata *conn,
    "USER",
    "PASS",
    "STARTTLS",
-    "LIST",
-    "LIST_SINGLE",
-    "RETR",
+    "COMMAND",
    "QUIT",
    /* LAST */
  };
@@ -262,7 +257,7 @@ static CURLcode pop3_state_user(struct connectdata *conn)

  /* send USER */
  result = Curl_pp_sendf(&conn->proto.pop3c.pp, "USER %s",
-                         pop3->user?pop3->user:"");
+                         pop3->user ? pop3->user : "");
  if(result)
    return result;

@@ -288,6 +283,34 @@ static void pop3_to_pop3s(struct connectdata *conn)
 #define pop3_to_pop3s(x) Curl_nop_stmt
 #endif

+/* for the initial server greeting */
+static CURLcode pop3_state_servergreet_resp(struct connectdata *conn,
+                                            int pop3code,
+                                            pop3state instate)
+{
+  CURLcode result = CURLE_OK;
+  struct SessionHandle *data = conn->data;
+  struct pop3_conn *pop3c = &conn->proto.pop3c;
+
+  (void)instate; /* no use for this yet */
+
+  if(pop3code != 'O') {
+    failf(data, "Got unexpected pop3-server response");
+    return CURLE_FTP_WEIRD_SERVER_REPLY;
+  }
+
+  if(data->set.use_ssl && !conn->ssl[FIRSTSOCKET].use) {
+    /* We don't have a SSL/TLS connection yet, but SSL is requested. Switch
+       to TLS connection now */
+    result = Curl_pp_sendf(&pop3c->pp, "STLS");
+    state(conn, POP3_STARTTLS);
+  }
+  else
+    result = pop3_state_user(conn);
+
+  return result;
+}
+
 /* for STARTTLS responses */
 static CURLcode pop3_state_starttls_resp(struct connectdata *conn,
                                         int pop3code,
@@ -295,6 +318,7 @@ static CURLcode pop3_state_starttls_resp(struct connectdata *conn,
 {
  CURLcode result = CURLE_OK;
  struct SessionHandle *data = conn->data;
+
  (void)instate; /* no use for this yet */

  if(pop3code != 'O') {
@@ -317,6 +341,7 @@ static CURLcode pop3_state_starttls_resp(struct connectdata *conn,
      state(conn, POP3_STOP);
    }
  }
+
  return result;
 }

@@ -338,11 +363,12 @@ static CURLcode pop3_state_user_resp(struct connectdata *conn,
  else
    /* send PASS */
    result = Curl_pp_sendf(&conn->proto.pop3c.pp, "PASS %s",
-                           pop3->passwd?pop3->passwd:"");
+                           pop3->passwd ? pop3->passwd : "");
  if(result)
    return result;

  state(conn, POP3_PASS);
+
  return result;
 }

@@ -353,6 +379,7 @@ static CURLcode pop3_state_pass_resp(struct connectdata *conn,
 {
  CURLcode result = CURLE_OK;
  struct SessionHandle *data = conn->data;
+
  (void)instate; /* no use for this yet */

  if(pop3code != 'O') {
@@ -361,56 +388,14 @@ static CURLcode pop3_state_pass_resp(struct connectdata *conn,
  }

  state(conn, POP3_STOP);
+
  return result;
 }

-/* for the retr response */
-static CURLcode pop3_state_retr_resp(struct connectdata *conn,
-                                     int pop3code,
-                                     pop3state instate)
-{
-  CURLcode result = CURLE_OK;
-  struct SessionHandle *data = conn->data;
-  struct FTP *pop3 = data->state.proto.pop3;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
-  struct pingpong *pp = &pop3c->pp;
-
-  (void)instate; /* no use for this yet */
-
-  if('O' != pop3code) {
-    state(conn, POP3_STOP);
-    return CURLE_RECV_ERROR;
-  }
-
-  /* POP3 download */
-  Curl_setup_transfer(conn, FIRSTSOCKET, -1, FALSE,
-                      pop3->bytecountp, -1, NULL); /* no upload here */
-
-  if(pp->cache) {
-    /* At this point there is a bunch of data in the header "cache" that is
-       actually body content, send it as body and then skip it. Do note
-       that there may even be additional "headers" after the body. */
-
-    /* we may get the EOB already here! */
-    result = Curl_pop3_write(conn, pp->cache, pp->cache_size);
-    if(result)
-      return result;
-
-    /* cache is drained */
-    free(pp->cache);
-    pp->cache = NULL;
-    pp->cache_size = 0;
-  }
-
-  state(conn, POP3_STOP);
-  return result;
-}
-
-
-/* for the list response */
-static CURLcode pop3_state_list_resp(struct connectdata *conn,
-                                     int pop3code,
-                                     pop3state instate)
+/* for the command response */
+static CURLcode pop3_state_command_resp(struct connectdata *conn,
+                                        int pop3code,
+                                        pop3state instate)
 {
  CURLcode result = CURLE_OK;
  struct SessionHandle *data = conn->data;
@@ -440,72 +425,63 @@ static CURLcode pop3_state_list_resp(struct connectdata *conn,
                      -1, NULL); /* no upload here */

  if(pp->cache) {
-    /* cache holds the email ID listing */
+    /* The header "cache" contains a bunch of data that is actually body
+       content so send it as such. Note that there may even be additional
+       "headers" after the body */

-    /* we may get the EOB already here! */
-    result = Curl_pop3_write(conn, pp->cache, pp->cache_size);
-    if(result)
-      return result;
+    if(!data->set.opt_no_body) {
+      result = Curl_pop3_write(conn, pp->cache, pp->cache_size);
+      if(result)
+        return result;
+    }

-    /* cache is drained */
-    free(pp->cache);
-    pp->cache = NULL;
+    /* Free the cache */
+    Curl_safefree(pp->cache);
+
+    /* Reset the cache size */
    pp->cache_size = 0;
  }

  state(conn, POP3_STOP);
+
  return result;
 }

-/* for LIST response with a given message */
-static CURLcode pop3_state_list_single_resp(struct connectdata *conn,
-                                     int pop3code,
-                                     pop3state instate)
+/* start the DO phase for the command */
+static CURLcode pop3_command(struct connectdata *conn)
 {
  CURLcode result = CURLE_OK;
-  struct SessionHandle *data = conn->data;
-  (void)instate; /* no use for this yet */
+  struct pop3_conn *pop3c = &conn->proto.pop3c;
+  const char *command = NULL;

-  if(pop3code != 'O') {
-    failf(data, "Invalid message. %c", pop3code);
-    result = CURLE_REMOTE_FILE_NOT_FOUND;
+  /* Calculate the default command */
+  if(pop3c->mailbox[0] == '\0' || conn->data->set.ftp_list_only) {
+    command = "LIST";
+
+    if(pop3c->mailbox[0] != '\0') {
+      /* Message specific LIST so skip the BODY transfer */
+      struct FTP *pop3 = conn->data->state.proto.pop3;
+      pop3->transfer = FTPTRANSFER_INFO;
+    }
  }
+  else
+    command = "RETR";

-  state(conn, POP3_STOP);
-  return result;
-}
+  /* Send the command */
+  if(pop3c->mailbox[0] != '\0')
+    result = Curl_pp_sendf(&conn->proto.pop3c.pp, "%s %s",
+                           (pop3c->custom && pop3c->custom[0] != '\0' ?
+                            pop3c->custom : command), pop3c->mailbox);
+  else
+    result = Curl_pp_sendf(&conn->proto.pop3c.pp,
+                           (pop3c->custom && pop3c->custom[0] != '\0' ?
+                            pop3c->custom : command));

-/* start the DO phase for RETR */
-static CURLcode pop3_retr(struct connectdata *conn)
-{
-  CURLcode result = CURLE_OK;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
-
-  result = Curl_pp_sendf(&conn->proto.pop3c.pp, "RETR %s", pop3c->mailbox);
  if(result)
    return result;

-  state(conn, POP3_RETR);
-  return result;
-}
+  state(conn, POP3_COMMAND);

-/* start the DO phase for LIST */
-static CURLcode pop3_list(struct connectdata *conn)
-{
-  CURLcode result = CURLE_OK;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
-
-  if(pop3c->mailbox[0] != '\0')
-    result = Curl_pp_sendf(&conn->proto.pop3c.pp, "LIST %s", pop3c->mailbox);
-  else
-    result = Curl_pp_sendf(&conn->proto.pop3c.pp, "LIST");
-  if(result)
-    return result;
-
-  if(pop3c->mailbox[0] != '\0')
-    state(conn, POP3_LIST_SINGLE);
-  else
-    state(conn, POP3_LIST);
  return result;
 }

@@ -513,7 +489,6 @@ static CURLcode pop3_statemach_act(struct connectdata *conn)
 {
  CURLcode result;
  curl_socket_t sock = conn->sock[FIRSTSOCKET];
-  struct SessionHandle *data=conn->data;
  int pop3code;
  struct pop3_conn *pop3c = &conn->proto.pop3c;
  struct pingpong *pp = &pop3c->pp;
@@ -531,21 +506,7 @@ static CURLcode pop3_statemach_act(struct connectdata *conn)
    /* we have now received a full POP3 server response */
    switch(pop3c->state) {
    case POP3_SERVERGREET:
-      if(pop3code != 'O') {
-        failf(data, "Got unexpected pop3-server response");
-        return CURLE_FTP_WEIRD_SERVER_REPLY;
-      }
-
-      if(data->set.use_ssl && !conn->ssl[FIRSTSOCKET].use) {
-        /* We don't have a SSL/TLS connection yet, but SSL is requested. Switch
-           to TLS connection now */
-        result = Curl_pp_sendf(&pop3c->pp, "STLS");
-        state(conn, POP3_STARTTLS);
-      }
-      else
-        result = pop3_state_user(conn);
-      if(result)
-        return result;
+      result = pop3_state_servergreet_resp(conn, pop3code, pop3c->state);
      break;

    case POP3_USER:
@@ -560,16 +521,8 @@ static CURLcode pop3_statemach_act(struct connectdata *conn)
      result = pop3_state_starttls_resp(conn, pop3code, pop3c->state);
      break;

-    case POP3_RETR:
-      result = pop3_state_retr_resp(conn, pop3code, pop3c->state);
-      break;
-
-    case POP3_LIST:
-      result = pop3_state_list_resp(conn, pop3code, pop3c->state);
-      break;
-
-    case POP3_LIST_SINGLE:
-      result = pop3_state_list_single_resp(conn, pop3code, pop3c->state);
+    case POP3_COMMAND:
+      result = pop3_state_command_resp(conn, pop3code, pop3c->state);
      break;

    case POP3_QUIT:
@@ -580,6 +533,7 @@ static CURLcode pop3_statemach_act(struct connectdata *conn)
      break;
    }
  }
+
  return result;
 }

@@ -617,6 +571,7 @@ static CURLcode pop3_init(struct connectdata *conn)
 {
  struct SessionHandle *data = conn->data;
  struct FTP *pop3 = data->state.proto.pop3;
+
  if(!pop3) {
    pop3 = data->state.proto.pop3 = calloc(sizeof(struct FTP), 1);
    if(!pop3)
@@ -645,11 +600,11 @@ static CURLcode pop3_init(struct connectdata *conn)
 * a part of the easy interface, it will always be TRUE.
 */
 static CURLcode pop3_connect(struct connectdata *conn,
-                                 bool *done) /* see description above */
+                             bool *done) /* see description above */
 {
  CURLcode result;
  struct pop3_conn *pop3c = &conn->proto.pop3c;
-  struct SessionHandle *data=conn->data;
+  struct SessionHandle *data = conn->data;
  struct pingpong *pp = &pop3c->pp;

  *done = FALSE; /* default to not done yet */
@@ -670,33 +625,6 @@ static CURLcode pop3_connect(struct connectdata *conn,
  pp->endofresp = pop3_endofresp;
  pp->conn = conn;

-  if(conn->bits.tunnel_proxy && conn->bits.httpproxy) {
-    /* for POP3 over HTTP proxy */
-    struct HTTP http_proxy;
-    struct FTP *pop3_save;
-
-    /* BLOCKING */
-    /* We want "seamless" POP3 operations through HTTP proxy tunnel */
-
-    /* Curl_proxyCONNECT is based on a pointer to a struct HTTP at the member
-     * conn->proto.http; we want POP3 through HTTP and we have to change the
-     * member temporarily for connecting to the HTTP proxy. After
-     * Curl_proxyCONNECT we have to set back the member to the original struct
-     * POP3 pointer
-     */
-    pop3_save = data->state.proto.pop3;
-    memset(&http_proxy, 0, sizeof(http_proxy));
-    data->state.proto.http = &http_proxy;
-
-    result = Curl_proxyCONNECT(conn, FIRSTSOCKET,
-                               conn->host.name, conn->remote_port);
-
-    data->state.proto.pop3 = pop3_save;
-
-    if(CURLE_OK != result)
-      return result;
-  }
-
  if(conn->handler->flags & PROTOPT_SSL) {
    /* BLOCKING */
    result = Curl_ssl_connect(conn, FIRSTSOCKET);
@@ -736,7 +664,8 @@ static CURLcode pop3_done(struct connectdata *conn, CURLcode status,
  struct SessionHandle *data = conn->data;
  struct FTP *pop3 = data->state.proto.pop3;
  struct pop3_conn *pop3c = &conn->proto.pop3c;
-  CURLcode result=CURLE_OK;
+  CURLcode result = CURLE_OK;
+
  (void)premature;

  if(!pop3)
@@ -749,13 +678,14 @@ static CURLcode pop3_done(struct connectdata *conn, CURLcode status,

  if(status) {
    conn->bits.close = TRUE; /* marked for closure */
-    result = status;      /* use the already set error code */
+    result = status;         /* use the already set error code */
  }

+  /* Clear our variables for the next connection */
  Curl_safefree(pop3c->mailbox);
-  pop3c->mailbox = NULL;
+  Curl_safefree(pop3c->custom);

-  /* clear these for next connection */
+  /* Clear the transfer mode for the next connection */
  pop3->transfer = FTPTRANSFER_BODY;

  return result;
@@ -775,8 +705,7 @@ CURLcode pop3_perform(struct connectdata *conn,
                     bool *dophase_done)
 {
  /* this is POP3 and no proxy */
-  CURLcode result=CURLE_OK;
-  struct pop3_conn *pop3c = &conn->proto.pop3c;
+  CURLcode result = CURLE_OK;

  DEBUGF(infof(conn->data, "DO phase starts\n"));

@@ -789,13 +718,7 @@ CURLcode pop3_perform(struct connectdata *conn,
  *dophase_done = FALSE; /* not done yet */

  /* start the first command in the DO phase */
-  /* If mailbox is empty, then assume user wants listing for mail IDs,
-   * otherwise, attempt to retrieve the mail-id stored in mailbox
-   */
-  if(strlen(pop3c->mailbox) && !conn->data->set.ftp_list_only)
-    result = pop3_retr(conn);
-  else
-    result = pop3_list(conn);
+  result = pop3_command(conn);
  if(result)
    return result;

@@ -840,10 +763,16 @@ static CURLcode pop3_do(struct connectdata *conn, bool *done)
  if(retcode)
    return retcode;

+  /* Parse the URL path */
  retcode = pop3_parse_url_path(conn);
  if(retcode)
    return retcode;

+  /* Parse the custom request */
+  retcode = pop3_parse_custom_request(conn);
+  if(retcode)
+    return retcode;
+
  retcode = pop3_regular_transfer(conn, done);

  return retcode;
@@ -865,6 +794,7 @@ static CURLcode pop3_quit(struct connectdata *conn)
  result = Curl_pp_sendf(&conn->proto.pop3c.pp, "QUIT", NULL);
  if(result)
    return result;
+
  state(conn, POP3_QUIT);

  result = pop3_easy_statemach(conn);
@@ -893,7 +823,6 @@ static CURLcode pop3_disconnect(struct connectdata *conn, bool dead_connection)
  if(!dead_connection && pop3c->pp.conn)
    (void)pop3_quit(conn); /* ignore errors on the LOGOUT */

-
  Curl_pp_disconnect(&pop3c->pp);

  return CURLE_OK;
@@ -913,15 +842,30 @@ static CURLcode pop3_parse_url_path(struct connectdata *conn)
  struct SessionHandle *data = conn->data;
  const char *path = data->state.path;

-  /* url decode the path and use this mailbox */
+  /* URL decode the path and use this mailbox */
  return Curl_urldecode(data, path, 0, &pop3c->mailbox, NULL, TRUE);
 }

+static CURLcode pop3_parse_custom_request(struct connectdata *conn)
+{
+  CURLcode result = CURLE_OK;
+  struct pop3_conn *pop3c = &conn->proto.pop3c;
+  struct SessionHandle *data = conn->data;
+  const char *custom = conn->data->set.str[STRING_CUSTOMREQUEST];
+
+  /* URL decode the custom request */
+  if(custom)
+    result = Curl_urldecode(data, custom, 0, &pop3c->custom, NULL, TRUE);
+
+  return result;
+}
+
 /* call this when the DO phase has completed */
 static CURLcode pop3_dophase_done(struct connectdata *conn,
                                  bool connected)
 {
  struct FTP *pop3 = conn->data->state.proto.pop3;
+
  (void)connected;

  if(pop3->transfer != FTPTRANSFER_BODY)
@@ -943,6 +887,7 @@ static CURLcode pop3_doing(struct connectdata *conn,

    DEBUGF(infof(conn->data, "DO phase is complete\n"));
  }
+
  return result;
 }

@@ -956,12 +901,11 @@ static CURLcode pop3_doing(struct connectdata *conn,
 * remote host.
 *
 */
-static
-CURLcode pop3_regular_transfer(struct connectdata *conn,
-                              bool *dophase_done)
+static CURLcode pop3_regular_transfer(struct connectdata *conn,
+                                      bool *dophase_done)
 {
-  CURLcode result=CURLE_OK;
-  bool connected=FALSE;
+  CURLcode result = CURLE_OK;
+  bool connected = FALSE;
  struct SessionHandle *data = conn->data;
  data->req.size = -1; /* make sure this is unknown at this point */

@@ -971,7 +915,7 @@ CURLcode pop3_regular_transfer(struct connectdata *conn,
  Curl_pgrsSetDownloadSize(data, 0);

  result = pop3_perform(conn,
-                        &connected, /* have we connected after PASV/PORT */
+                        &connected,    /* have we connected after PASV/PORT */
                        dophase_done); /* all commands in the DO-phase done? */

  if(CURLE_OK == result) {
@@ -1006,6 +950,7 @@ static CURLcode pop3_setup_connection(struct connectdata * conn)
      return CURLE_UNSUPPORTED_PROTOCOL;
 #endif
    }
+
    /*
     * We explicitly mark this connection as persistent here as we're doing
     * POP3 over HTTP and thus we accidentally avoid setting this value
@@ -1035,7 +980,7 @@ CURLcode Curl_pop3_write(struct connectdata *conn,
                         char *str,
                         size_t nread)
 {
-  /* This code could be made into a special function in the handler struct. */
+  /* This code could be made into a special function in the handler struct */
  CURLcode result = CURLE_OK;
  struct SessionHandle *data = conn->data;
  struct SingleRequest *k = &data->req;
@@ -1131,10 +1076,15 @@ CURLcode Curl_pop3_write(struct connectdata *conn,
  }

  if(pop3c->eob == POP3_EOB_LEN) {
-    /* We have a full match so the transfer is done! */
+    /* We have a full match so the transfer is done, however we must transfer
+    the CRLF at the start of the EOB as this is considered to be part of the
+    message as per RFC-1939, sect. 3 */
+    result = Curl_client_write(conn, CLIENTWRITE_BODY, (char*)POP3_EOB, 2);
+
    k->keepon &= ~KEEP_RECV;
    pop3c->eob = 0;
-    return CURLE_OK;
+
+    return result;
  }

  if(pop3c->eob)
--- a/lib/pop3.h
+++ b/lib/pop3.h
@@ -7,7 +7,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 2009 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 2009 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -32,9 +32,7 @@ typedef enum {
  POP3_USER,
  POP3_PASS,
  POP3_STARTTLS,
-  POP3_LIST,
-  POP3_LIST_SINGLE,
-  POP3_RETR,
+  POP3_COMMAND,
  POP3_QUIT,
  POP3_LAST  /* never used */
 } pop3state;
@@ -43,11 +41,12 @@ typedef enum {
   struct */
 struct pop3_conn {
  struct pingpong pp;
-  char *mailbox;     /* what to RETR */
+  char *mailbox;     /* message id */
+  char *custom;      /* custom request */
  size_t eob;        /* number of bytes of the EOB (End Of Body) that has been
                        received thus far */
  size_t strip;      /* number of bytes from the start to ignore as non-body */
-  pop3state state; /* always use pop3.c:state() to change state! */
+  pop3state state;   /* always use pop3.c:state() to change state! */
 };

 extern const struct Curl_handler Curl_handler_pop3;
--- a/lib/progress.c
+++ b/lib/progress.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -146,13 +146,16 @@ void Curl_pgrsDone(struct connectdata *conn)
  data->progress.speeder_c = 0; /* reset the progress meter display */
 }

-/* reset all times except redirect */
-void Curl_pgrsResetTimes(struct SessionHandle *data)
+/* reset all times except redirect, and reset the known transfer sizes */
+void Curl_pgrsResetTimesSizes(struct SessionHandle *data)
 {
  data->progress.t_nslookup = 0.0;
  data->progress.t_connect = 0.0;
  data->progress.t_pretransfer = 0.0;
  data->progress.t_starttransfer = 0.0;
+
+  Curl_pgrsSetDownloadSize(data, 0);
+  Curl_pgrsSetUploadSize(data, 0);
 }

 void Curl_pgrsTime(struct SessionHandle *data, timerid timer)
--- a/lib/progress.h
+++ b/lib/progress.h
@@ -7,7 +7,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2008, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -46,7 +46,7 @@ void Curl_pgrsSetUploadSize(struct SessionHandle *data, curl_off_t size);
 void Curl_pgrsSetDownloadCounter(struct SessionHandle *data, curl_off_t size);
 void Curl_pgrsSetUploadCounter(struct SessionHandle *data, curl_off_t size);
 int Curl_pgrsUpdate(struct connectdata *);
-void Curl_pgrsResetTimes(struct SessionHandle *data);
+void Curl_pgrsResetTimesSizes(struct SessionHandle *data);
 void Curl_pgrsTime(struct SessionHandle *data, timerid timer);


--- a/lib/setup.h
+++ b/lib/setup.h
@@ -1,5 +1,5 @@
-#ifndef HEADER_CURL_LIB_SETUP_H
-#define HEADER_CURL_LIB_SETUP_H
+#ifndef HEADER_CURL_SETUP_H
+#define HEADER_CURL_SETUP_H
 /***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
@@ -54,8 +54,12 @@
 #  include "config-mac.h"
 #endif

+#ifdef __riscos__
+#  include "config-riscos.h"
+#endif
+
 #ifdef __AMIGA__
-#  include "amigaos.h"
+#  include "config-amigaos.h"
 #endif

 #ifdef __SYMBIAN32__
@@ -281,6 +285,16 @@
 #  include <ioLib.h>      /* for basic I/O interface functions */
 #endif

+#ifdef __AMIGA__
+#  ifndef __ixemul__
+#    include <exec/types.h>
+#    include <exec/execbase.h>
+#    include <proto/exec.h>
+#    include <proto/dos.h>
+#    define select(a,b,c,d,e) WaitSelect(a,b,c,d,e,0)
+#  endif
+#endif
+
 #include <stdio.h>
 #ifdef HAVE_ASSERT_H
 #include <assert.h>
@@ -591,13 +605,17 @@ int netware_init(void);
 #define S_ISREG(m) (((m) & S_IFMT) == S_IFREG)
 #endif

-/* Provide a mechanism to silence picky compilers, such as gcc 4.6+.
-   Parameters should of course normally not be unused, but for example when we
-   have multiple implementations of the same interface it may happen. */
-#ifndef __GNUC__
-#define UNUSED_PARAM /*NOTHING*/
+/*
+ * Provide a mechanism to silence picky compilers, such as gcc 4.6+.
+ * Parameters should of course normally not be unused, but for example when
+ * we have multiple implementations of the same interface it may happen.
+ */
+
+#if defined(__GNUC__) && ((__GNUC__ >= 3) || \
+  ((__GNUC__ == 2) && defined(__GNUC_MINOR__) && (__GNUC_MINOR__ >= 7)))
+#  define UNUSED_PARAM __attribute__((__unused__))
 #else
-#define UNUSED_PARAM __attribute__((unused))
+#  define UNUSED_PARAM /*NOTHING*/
 #endif

 /*
@@ -623,7 +641,6 @@ int netware_init(void);
 #if defined(__LWIP_OPT_H__)
 #  if defined(SOCKET) || \
     defined(USE_WINSOCK) || \
-     defined(HAVE_ERRNO_H) || \
     defined(HAVE_WINSOCK_H) || \
     defined(HAVE_WINSOCK2_H) || \
     defined(HAVE_WS2TCPIP_H)
@@ -641,4 +658,4 @@ int netware_init(void);
 #  define SHUT_RDWR 0x02
 #endif

-#endif /* HEADER_CURL_LIB_SETUP_H */
+#endif /* HEADER_CURL_SETUP_H */
--- a/lib/setup_once.h
+++ b/lib/setup_once.h
@@ -7,7 +7,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -79,7 +79,7 @@
 #include <fcntl.h>
 #endif

-#ifdef HAVE_STDBOOL_H
+#if defined(HAVE_STDBOOL_H) && defined(HAVE_BOOL_T)
 #include <stdbool.h>
 #endif

@@ -239,10 +239,21 @@ struct timeval {
 #  define sclose(x)  closesocket((x))
 #elif defined(HAVE_CLOSESOCKET_CAMEL)
 #  define sclose(x)  CloseSocket((x))
+#elif defined(USE_LWIPSOCK)
+#  define sclose(x)  lwip_close((x))
 #else
 #  define sclose(x)  close((x))
 #endif

+/*
+ * Stack-independent version of fcntl() on sockets:
+ */
+#if defined(USE_LWIPSOCK)
+#  define sfcntl  lwip_fcntl
+#else
+#  define sfcntl  fcntl
+#endif
+
 /*
 * Uppercase macro versions of ANSI/ISO is*() functions/macros which
 * avoid negative number inputs with argument byte codes > 127.
--- a/lib/smtp.c
+++ b/lib/smtp.c
--- a/lib/smtp.h
+++ b/lib/smtp.h
@@ -7,7 +7,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 2009 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 2009 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -39,7 +39,9 @@ typedef enum {
  SMTP_AUTHPLAIN,
  SMTP_AUTHLOGIN,
  SMTP_AUTHPASSWD,
-  SMTP_AUTHCRAM,
+  SMTP_AUTHCRAMMD5,
+  SMTP_AUTHDIGESTMD5,
+  SMTP_AUTHDIGESTMD5_RESP,
  SMTP_AUTHNTLM,
  SMTP_AUTHNTLM_TYPE2MSG,
  SMTP_AUTH,
@@ -80,6 +82,7 @@ extern const struct Curl_handler Curl_handler_smtps;
 /* this is the 5-bytes End-Of-Body marker for SMTP */
 #define SMTP_EOB "\x0d\x0a\x2e\x0d\x0a"
 #define SMTP_EOB_LEN 5
+#define SMTP_EOB_FIND_LEN 3

 /* if found in data, replace it with this string instead */
 #define SMTP_EOB_REPL "\x0d\x0a\x2e\x2e"
--- a/lib/ssh.c
+++ b/lib/ssh.c
@@ -5,7 +5,7 @@
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
@@ -108,8 +108,14 @@
                         have their definition hidden well */
 #endif

+#define sftp_libssh2_last_error(s) curlx_ultosi(libssh2_sftp_last_error(s))
+
+#define sftp_libssh2_realpath(s,p,t,m) \
+        libssh2_sftp_symlink_ex((s), (p), curlx_uztoui(strlen(p)), \
+                                (t), (m), LIBSSH2_SFTP_REALPATH)
+
 /* Local functions: */
-static const char *sftp_libssh2_strerror(unsigned long err);
+static const char *sftp_libssh2_strerror(int err);
 static LIBSSH2_ALLOC_FUNC(my_libssh2_malloc);
 static LIBSSH2_REALLOC_FUNC(my_libssh2_realloc);
 static LIBSSH2_FREE_FUNC(my_libssh2_free);
@@ -225,7 +231,7 @@ kbd_callback(const char *name, int name_len, const char *instruction,
 #endif  /* CURL_LIBSSH2_DEBUG */
  if(num_prompts == 1) {
    responses[0].text = strdup(conn->passwd);
-    responses[0].length = (unsigned int)strlen(conn->passwd);
+    responses[0].length = curlx_uztoui(strlen(conn->passwd));
  }
  (void)prompts;
  (void)abstract;
@@ -734,7 +740,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
       */
      sshc->authlist = libssh2_userauth_list(sshc->ssh_session,
                                             conn->user,
-                                             (unsigned int)strlen(conn->user));
+                                             curlx_uztoui(strlen(conn->user)));

      if(!sshc->authlist) {
        if((err = libssh2_session_last_errno(sshc->ssh_session)) ==
@@ -763,7 +769,8 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)

      if((data->set.ssh_auth_types & CURLSSH_AUTH_PUBLICKEY) &&
         (strstr(sshc->authlist, "publickey") != NULL)) {
-        char *home;
+        char *home = NULL;
+        bool rsa_pub_empty_but_ok = FALSE;

        sshc->rsa_pub = sshc->rsa = NULL;

@@ -771,7 +778,10 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
           HOME environment variable etc? */
        home = curl_getenv("HOME");

-        if(data->set.str[STRING_SSH_PUBLIC_KEY])
+        if(data->set.str[STRING_SSH_PUBLIC_KEY] &&
+           !*data->set.str[STRING_SSH_PUBLIC_KEY])
+           rsa_pub_empty_but_ok = true;
+        else if(data->set.str[STRING_SSH_PUBLIC_KEY])
          sshc->rsa_pub = aprintf("%s", data->set.str[STRING_SSH_PUBLIC_KEY]);
        else if(home)
          sshc->rsa_pub = aprintf("%s/.ssh/id_dsa.pub", home);
@@ -779,9 +789,8 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
          /* as a final resort, try current dir! */
          sshc->rsa_pub = strdup("id_dsa.pub");

-        if(sshc->rsa_pub == NULL) {
+        if(!rsa_pub_empty_but_ok && (sshc->rsa_pub == NULL)) {
          Curl_safefree(home);
-          home = NULL;
          state(conn, SSH_SESSION_FREE);
          sshc->actualcode = CURLE_OUT_OF_MEMORY;
          break;
@@ -797,9 +806,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)

        if(sshc->rsa == NULL) {
          Curl_safefree(home);
-          home = NULL;
          Curl_safefree(sshc->rsa_pub);
-          sshc->rsa_pub = NULL;
          state(conn, SSH_SESSION_FREE);
          sshc->actualcode = CURLE_OUT_OF_MEMORY;
          break;
@@ -810,7 +817,6 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
          sshc->passphrase = "";

        Curl_safefree(home);
-        home = NULL;

        infof(data, "Using ssh public key file %s\n", sshc->rsa_pub);
        infof(data, "Using ssh private key file %s\n", sshc->rsa);
@@ -827,8 +833,8 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
       */
      rc = libssh2_userauth_publickey_fromfile_ex(sshc->ssh_session,
                                                  conn->user,
-                                                  (unsigned int)
-                                                  strlen(conn->user),
+                                                  curlx_uztoui(
+                                                    strlen(conn->user)),
                                                  sshc->rsa_pub,
                                                  sshc->rsa, sshc->passphrase);
      if(rc == LIBSSH2_ERROR_EAGAIN) {
@@ -836,9 +842,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
      }

      Curl_safefree(sshc->rsa_pub);
-      sshc->rsa_pub = NULL;
      Curl_safefree(sshc->rsa);
-      sshc->rsa = NULL;

      if(rc == 0) {
        sshc->authed = TRUE;
@@ -866,9 +870,9 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)

    case SSH_AUTH_PASS:
      rc = libssh2_userauth_password_ex(sshc->ssh_session, conn->user,
-                                        (unsigned int)strlen(conn->user),
+                                        curlx_uztoui(strlen(conn->user)),
                                        conn->passwd,
-                                        (unsigned int)strlen(conn->passwd),
+                                        curlx_uztoui(strlen(conn->passwd)),
                                        NULL);
      if(rc == LIBSSH2_ERROR_EAGAIN) {
        break;
@@ -911,8 +915,8 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
      /* Authentication failed. Continue with keyboard-interactive now. */
      rc = libssh2_userauth_keyboard_interactive_ex(sshc->ssh_session,
                                                    conn->user,
-                                                    (unsigned int)
-                                                    strlen(conn->user),
+                                                    curlx_uztoui(
+                                                      strlen(conn->user)),
                                                    &kbd_callback);
      if(rc == LIBSSH2_ERROR_EAGAIN) {
        break;
@@ -982,7 +986,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
      /*
       * Get the "home" directory
       */
-      rc = libssh2_sftp_realpath(sshc->sftp_session, ".",
+      rc = sftp_libssh2_realpath(sshc->sftp_session, ".",
                                 tempHome, PATH_MAX-1);
      if(rc == LIBSSH2_ERROR_EAGAIN) {
        break;
@@ -1000,7 +1004,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
      }
      else {
        /* Return the error type */
-        err = (int)(libssh2_sftp_last_error(sshc->sftp_session));
+        err = sftp_libssh2_last_error(sshc->sftp_session);
        result = sftp_libssh2_error_to_CURLE(err);
        sshc->actualcode = result?result:CURLE_SSH;
        DEBUGF(infof(data, "error = %d makes libcurl = %d\n",
@@ -1141,7 +1145,6 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
              failf(data, "Syntax error in chgrp/chmod/chown: "
                    "Bad second parameter");
            Curl_safefree(sshc->quote_path1);
-            sshc->quote_path1 = NULL;
            state(conn, SSH_SFTP_CLOSE);
            sshc->nextstate = SSH_NO_STATE;
            sshc->actualcode = result;
@@ -1164,7 +1167,6 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
              failf(data,
                    "Syntax error in ln/symlink: Bad second parameter");
            Curl_safefree(sshc->quote_path1);
-            sshc->quote_path1 = NULL;
            state(conn, SSH_SFTP_CLOSE);
            sshc->nextstate = SSH_NO_STATE;
            sshc->actualcode = result;
@@ -1189,7 +1191,6 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
            else
              failf(data, "Syntax error in rename: Bad second parameter");
            Curl_safefree(sshc->quote_path1);
-            sshc->quote_path1 = NULL;
            state(conn, SSH_SFTP_CLOSE);
            sshc->nextstate = SSH_NO_STATE;
            sshc->actualcode = result;
@@ -1210,9 +1211,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)

        failf(data, "Unknown SFTP command");
        Curl_safefree(sshc->quote_path1);
-        sshc->quote_path1 = NULL;
        Curl_safefree(sshc->quote_path2);
-        sshc->quote_path2 = NULL;
        state(conn, SSH_SFTP_CLOSE);
        sshc->nextstate = SSH_NO_STATE;
        sshc->actualcode = CURLE_QUOTE_ERROR;
@@ -1225,14 +1224,8 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
    break;

    case SSH_SFTP_NEXT_QUOTE:
-      if(sshc->quote_path1) {
-        Curl_safefree(sshc->quote_path1);
-        sshc->quote_path1 = NULL;
-      }
-      if(sshc->quote_path2) {
-        Curl_safefree(sshc->quote_path2);
-        sshc->quote_path2 = NULL;
-      }
+      Curl_safefree(sshc->quote_path1);
+      Curl_safefree(sshc->quote_path2);

      sshc->quote_item = sshc->quote_item->next;

@@ -1271,18 +1264,16 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
         * first.  This takes an extra protocol round trip.
         */
        rc = libssh2_sftp_stat_ex(sshc->sftp_session, sshc->quote_path2,
-                                  (unsigned int)strlen(sshc->quote_path2),
+                                  curlx_uztoui(strlen(sshc->quote_path2)),
                                  LIBSSH2_SFTP_STAT,
                                  &sshc->quote_attrs);
        if(rc == LIBSSH2_ERROR_EAGAIN) {
          break;
        }
        else if(rc != 0 && !sshc->acceptfail) { /* get those attributes */
-          err = (int)(libssh2_sftp_last_error(sshc->sftp_session));
+          err = sftp_libssh2_last_error(sshc->sftp_session);
          Curl_safefree(sshc->quote_path1);
-          sshc->quote_path1 = NULL;
          Curl_safefree(sshc->quote_path2);
-          sshc->quote_path2 = NULL;
          failf(data, "Attempt to get SFTP stats failed: %s",
                sftp_libssh2_strerror(err));
          state(conn, SSH_SFTP_CLOSE);
@@ -1299,9 +1290,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
        if(sshc->quote_attrs.gid == 0 && !ISDIGIT(sshc->quote_path1[0]) &&
           !sshc->acceptfail) {
          Curl_safefree(sshc->quote_path1);
-          sshc->quote_path1 = NULL;
          Curl_safefree(sshc->quote_path2);
-          sshc->quote_path2 = NULL;
          failf(data, "Syntax error: chgrp gid not a number");
          state(conn, SSH_SFTP_CLOSE);
          sshc->nextstate = SSH_NO_STATE;
@@ -1316,9 +1305,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
        if(sshc->quote_attrs.permissions == 0 &&
           !ISDIGIT(sshc->quote_path1[0])) {
          Curl_safefree(sshc->quote_path1);
-          sshc->quote_path1 = NULL;
          Curl_safefree(sshc->quote_path2);
-          sshc->quote_path2 = NULL;
          failf(data, "Syntax error: chmod permissions not a number");
          state(conn, SSH_SFTP_CLOSE);
          sshc->nextstate = SSH_NO_STATE;
@@ -1332,9 +1319,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
        if(sshc->quote_attrs.uid == 0 && !ISDIGIT(sshc->quote_path1[0]) &&
           !sshc->acceptfail) {
          Curl_safefree(sshc->quote_path1);
-          sshc->quote_path1 = NULL;
          Curl_safefree(sshc->quote_path2);
-          sshc->quote_path2 = NULL;
          failf(data, "Syntax error: chown uid not a number");
          state(conn, SSH_SFTP_CLOSE);
          sshc->nextstate = SSH_NO_STATE;
@@ -1350,18 +1335,16 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)

    case SSH_SFTP_QUOTE_SETSTAT:
      rc = libssh2_sftp_stat_ex(sshc->sftp_session, sshc->quote_path2,
-                                (unsigned int)strlen(sshc->quote_path2),
+                                curlx_uztoui(strlen(sshc->quote_path2)),
                                LIBSSH2_SFTP_SETSTAT,
                                &sshc->quote_attrs);
      if(rc == LIBSSH2_ERROR_EAGAIN) {
        break;
      }
      else if(rc != 0 && !sshc->acceptfail) {
-        err = (int)(libssh2_sftp_last_error(sshc->sftp_session));
+        err = sftp_libssh2_last_error(sshc->sftp_session);
        Curl_safefree(sshc->quote_path1);
-        sshc->quote_path1 = NULL;
        Curl_safefree(sshc->quote_path2);
-        sshc->quote_path2 = NULL;
        failf(data, "Attempt to set SFTP stats failed: %s",
              sftp_libssh2_strerror(err));
        state(conn, SSH_SFTP_CLOSE);
@@ -1374,19 +1357,17 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)

    case SSH_SFTP_QUOTE_SYMLINK:
      rc = libssh2_sftp_symlink_ex(sshc->sftp_session, sshc->quote_path1,
-                                   (unsigned int)strlen(sshc->quote_path1),
+                                   curlx_uztoui(strlen(sshc->quote_path1)),
                                   sshc->quote_path2,
-                                   (unsigned int)strlen(sshc->quote_path2),
+                                   curlx_uztoui(strlen(sshc->quote_path2)),
                                   LIBSSH2_SFTP_SYMLINK);
      if(rc == LIBSSH2_ERROR_EAGAIN) {
        break;
      }
      else if(rc != 0 && !sshc->acceptfail) {
-        err = (int)(libssh2_sftp_last_error(sshc->sftp_session));
+        err = sftp_libssh2_last_error(sshc->sftp_session);
        Curl_safefree(sshc->quote_path1);
-        sshc->quote_path1 = NULL;
        Curl_safefree(sshc->quote_path2);
-        sshc->quote_path2 = NULL;
        failf(data, "symlink command failed: %s",
              sftp_libssh2_strerror(err));
        state(conn, SSH_SFTP_CLOSE);
@@ -1399,15 +1380,14 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)

    case SSH_SFTP_QUOTE_MKDIR:
      rc = libssh2_sftp_mkdir_ex(sshc->sftp_session, sshc->quote_path1,
-                                 (unsigned int)strlen(sshc->quote_path1),
+                                 curlx_uztoui(strlen(sshc->quote_path1)),
                                 data->set.new_directory_perms);
      if(rc == LIBSSH2_ERROR_EAGAIN) {
        break;
      }
      else if(rc != 0 && !sshc->acceptfail) {
-        err = (int)(libssh2_sftp_last_error(sshc->sftp_session));
+        err = sftp_libssh2_last_error(sshc->sftp_session);
        Curl_safefree(sshc->quote_path1);
-        sshc->quote_path1 = NULL;
        failf(data, "mkdir command failed: %s", sftp_libssh2_strerror(err));
        state(conn, SSH_SFTP_CLOSE);
        sshc->nextstate = SSH_NO_STATE;
@@ -1419,9 +1399,9 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)

    case SSH_SFTP_QUOTE_RENAME:
      rc = libssh2_sftp_rename_ex(sshc->sftp_session, sshc->quote_path1,
-                                  (unsigned int)strlen(sshc->quote_path1),
+                                  curlx_uztoui(strlen(sshc->quote_path1)),
                                  sshc->quote_path2,
-                                  (unsigned int)strlen(sshc->quote_path2),
+                                  curlx_uztoui(strlen(sshc->quote_path2)),
                                  LIBSSH2_SFTP_RENAME_OVERWRITE |
                                  LIBSSH2_SFTP_RENAME_ATOMIC |
                                  LIBSSH2_SFTP_RENAME_NATIVE);
@@ -1430,11 +1410,9 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
        break;
      }
      else if(rc != 0 && !sshc->acceptfail) {
-        err = (int)(libssh2_sftp_last_error(sshc->sftp_session));
+        err = sftp_libssh2_last_error(sshc->sftp_session);
        Curl_safefree(sshc->quote_path1);
-        sshc->quote_path1 = NULL;
        Curl_safefree(sshc->quote_path2);
-        sshc->quote_path2 = NULL;
        failf(data, "rename command failed: %s", sftp_libssh2_strerror(err));
        state(conn, SSH_SFTP_CLOSE);
        sshc->nextstate = SSH_NO_STATE;
@@ -1446,14 +1424,13 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)

    case SSH_SFTP_QUOTE_RMDIR:
      rc = libssh2_sftp_rmdir_ex(sshc->sftp_session, sshc->quote_path1,
-                                 (unsigned int)strlen(sshc->quote_path1));
+                                 curlx_uztoui(strlen(sshc->quote_path1)));
      if(rc == LIBSSH2_ERROR_EAGAIN) {
        break;
      }
      else if(rc != 0 && !sshc->acceptfail) {
-        err = (int)(libssh2_sftp_last_error(sshc->sftp_session));
+        err = sftp_libssh2_last_error(sshc->sftp_session);
        Curl_safefree(sshc->quote_path1);
-        sshc->quote_path1 = NULL;
        failf(data, "rmdir command failed: %s", sftp_libssh2_strerror(err));
        state(conn, SSH_SFTP_CLOSE);
        sshc->nextstate = SSH_NO_STATE;
@@ -1465,14 +1442,13 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)

    case SSH_SFTP_QUOTE_UNLINK:
      rc = libssh2_sftp_unlink_ex(sshc->sftp_session, sshc->quote_path1,
-                                  (unsigned int)strlen(sshc->quote_path1));
+                                  curlx_uztoui(strlen(sshc->quote_path1)));
      if(rc == LIBSSH2_ERROR_EAGAIN) {
        break;
      }
      else if(rc != 0 && !sshc->acceptfail) {
-        err = (int)(libssh2_sftp_last_error(sshc->sftp_session));
+        err = sftp_libssh2_last_error(sshc->sftp_session);
        Curl_safefree(sshc->quote_path1);
-        sshc->quote_path1 = NULL;
        failf(data, "rm command failed: %s", sftp_libssh2_strerror(err));
        state(conn, SSH_SFTP_CLOSE);
        sshc->nextstate = SSH_NO_STATE;
@@ -1509,7 +1485,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
        LIBSSH2_SFTP_ATTRIBUTES attrs;
        if(data->state.resume_from < 0) {
          rc = libssh2_sftp_stat_ex(sshc->sftp_session, sftp_scp->path,
-                                    (unsigned int)strlen(sftp_scp->path),
+                                    curlx_uztoui(strlen(sftp_scp->path)),
                                    LIBSSH2_SFTP_STAT, &attrs);
          if(rc == LIBSSH2_ERROR_EAGAIN) {
            break;
@@ -1540,7 +1516,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)

      sshc->sftp_handle =
        libssh2_sftp_open_ex(sshc->sftp_session, sftp_scp->path,
-                             (unsigned int)strlen(sftp_scp->path),
+                             curlx_uztoui(strlen(sftp_scp->path)),
                             flags, data->set.new_file_perms,
                             LIBSSH2_SFTP_OPENFILE);

@@ -1553,7 +1529,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
          if(LIBSSH2_ERROR_SFTP_PROTOCOL == rc)
            /* only when there was an SFTP protocol error can we extract
               the sftp error! */
-            err = (int)(libssh2_sftp_last_error(sshc->sftp_session));
+            err = sftp_libssh2_last_error(sshc->sftp_session);
          else
            err = -1; /* not an sftp error at all */

@@ -1699,7 +1675,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
    case SSH_SFTP_CREATE_DIRS_MKDIR:
      /* 'mode' - parameter is preliminary - default to 0644 */
      rc = libssh2_sftp_mkdir_ex(sshc->sftp_session, sftp_scp->path,
-                                 (unsigned int)strlen(sftp_scp->path),
+                                 curlx_uztoui(strlen(sftp_scp->path)),
                                 data->set.new_directory_perms);
      if(rc == LIBSSH2_ERROR_EAGAIN) {
        break;
@@ -1707,17 +1683,16 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
      *sshc->slash_pos = '/';
      ++sshc->slash_pos;
      if(rc == -1) {
-        unsigned int sftp_err = 0;
        /*
         * Abort if failure wasn't that the dir already exists or the
         * permission was denied (creation might succeed further down the
         * path) - retry on unspecific FAILURE also
         */
-        sftp_err = (unsigned int)(libssh2_sftp_last_error(sshc->sftp_session));
-        if((sftp_err != LIBSSH2_FX_FILE_ALREADY_EXISTS) &&
-           (sftp_err != LIBSSH2_FX_FAILURE) &&
-           (sftp_err != LIBSSH2_FX_PERMISSION_DENIED)) {
-          result = sftp_libssh2_error_to_CURLE(sftp_err);
+        err = sftp_libssh2_last_error(sshc->sftp_session);
+        if((err != LIBSSH2_FX_FILE_ALREADY_EXISTS) &&
+           (err != LIBSSH2_FX_FAILURE) &&
+           (err != LIBSSH2_FX_PERMISSION_DENIED)) {
+          result = sftp_libssh2_error_to_CURLE(err);
          state(conn, SSH_SFTP_CLOSE);
          sshc->actualcode = result?result:CURLE_SSH;
          break;
@@ -1733,8 +1708,8 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
       */
      sshc->sftp_handle = libssh2_sftp_open_ex(sshc->sftp_session,
                                               sftp_scp->path,
-                                               (unsigned int)
-                                               strlen(sftp_scp->path),
+                                               curlx_uztoui(
+                                                 strlen(sftp_scp->path)),
                                               0, 0, LIBSSH2_SFTP_OPENDIR);
      if(!sshc->sftp_handle) {
        if(libssh2_session_last_errno(sshc->ssh_session) ==
@@ -1743,7 +1718,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
          break;
        }
        else {
-          err = (int)(libssh2_sftp_last_error(sshc->sftp_session));
+          err = sftp_libssh2_last_error(sshc->sftp_session);
          failf(data, "Could not open directory for reading: %s",
                sftp_libssh2_strerror(err));
          state(conn, SSH_SFTP_CLOSE);
@@ -1759,7 +1734,6 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
      }
      if((sshc->readdir_longentry = malloc(PATH_MAX+1)) == NULL) {
        Curl_safefree(sshc->readdir_filename);
-        sshc->readdir_filename = NULL;
        state(conn, SSH_SFTP_CLOSE);
        sshc->actualcode = CURLE_OUT_OF_MEMORY;
        break;
@@ -1814,9 +1788,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
          sshc->readdir_line = calloc(sshc->readdir_totalLen, 1);
          if(!sshc->readdir_line) {
            Curl_safefree(sshc->readdir_filename);
-            sshc->readdir_filename = NULL;
            Curl_safefree(sshc->readdir_longentry);
-            sshc->readdir_longentry = NULL;
            state(conn, SSH_SFTP_CLOSE);
            sshc->actualcode = CURLE_OUT_OF_MEMORY;
            break;
@@ -1830,9 +1802,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
            sshc->readdir_linkPath = malloc(PATH_MAX + 1);
            if(sshc->readdir_linkPath == NULL) {
              Curl_safefree(sshc->readdir_filename);
-              sshc->readdir_filename = NULL;
              Curl_safefree(sshc->readdir_longentry);
-              sshc->readdir_longentry = NULL;
              state(conn, SSH_SFTP_CLOSE);
              sshc->actualcode = CURLE_OUT_OF_MEMORY;
              break;
@@ -1849,23 +1819,19 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
      }
      else if(sshc->readdir_len == 0) {
        Curl_safefree(sshc->readdir_filename);
-        sshc->readdir_filename = NULL;
        Curl_safefree(sshc->readdir_longentry);
-        sshc->readdir_longentry = NULL;
        state(conn, SSH_SFTP_READDIR_DONE);
        break;
      }
      else if(sshc->readdir_len <= 0) {
-        err = (int)(libssh2_sftp_last_error(sshc->sftp_session));
+        err = sftp_libssh2_last_error(sshc->sftp_session);
        result = sftp_libssh2_error_to_CURLE(err);
        sshc->actualcode = result?result:CURLE_SSH;
        failf(data, "Could not open remote file for reading: %s :: %d",
              sftp_libssh2_strerror(err),
              libssh2_session_last_errno(sshc->ssh_session));
        Curl_safefree(sshc->readdir_filename);
-        sshc->readdir_filename = NULL;
        Curl_safefree(sshc->readdir_longentry);
-        sshc->readdir_longentry = NULL;
        state(conn, SSH_SFTP_CLOSE);
        break;
      }
@@ -1875,7 +1841,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
      sshc->readdir_len =
        libssh2_sftp_symlink_ex(sshc->sftp_session,
                                sshc->readdir_linkPath,
-                                (unsigned int) strlen(sshc->readdir_linkPath),
+                                curlx_uztoui(strlen(sshc->readdir_linkPath)),
                                sshc->readdir_filename,
                                PATH_MAX, LIBSSH2_SFTP_READLINK);
      if(sshc->readdir_len == LIBSSH2_ERROR_EAGAIN) {
@@ -1883,18 +1849,14 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
        break;
      }
      Curl_safefree(sshc->readdir_linkPath);
-      sshc->readdir_linkPath = NULL;

      /* get room for the filename and extra output */
      sshc->readdir_totalLen += 4 + sshc->readdir_len;
      new_readdir_line = realloc(sshc->readdir_line, sshc->readdir_totalLen);
      if(!new_readdir_line) {
        Curl_safefree(sshc->readdir_line);
-        sshc->readdir_line = NULL;
        Curl_safefree(sshc->readdir_filename);
-        sshc->readdir_filename = NULL;
        Curl_safefree(sshc->readdir_longentry);
-        sshc->readdir_longentry = NULL;
        state(conn, SSH_SFTP_CLOSE);
        sshc->actualcode = CURLE_OUT_OF_MEMORY;
        break;
@@ -1930,7 +1892,6 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
        data->req.bytecount += sshc->readdir_currLen;
      }
      Curl_safefree(sshc->readdir_line);
-      sshc->readdir_line = NULL;
      if(result) {
        state(conn, SSH_STOP);
      }
@@ -1946,9 +1907,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
      }
      sshc->sftp_handle = NULL;
      Curl_safefree(sshc->readdir_filename);
-      sshc->readdir_filename = NULL;
      Curl_safefree(sshc->readdir_longentry);
-      sshc->readdir_longentry = NULL;

      /* no data to transfer */
      Curl_setup_transfer(conn, -1, -1, FALSE, NULL, -1, NULL);
@@ -1961,7 +1920,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
       */
      sshc->sftp_handle =
        libssh2_sftp_open_ex(sshc->sftp_session, sftp_scp->path,
-                             (unsigned int)strlen(sftp_scp->path),
+                             curlx_uztoui(strlen(sftp_scp->path)),
                             LIBSSH2_FXF_READ, data->set.new_file_perms,
                             LIBSSH2_SFTP_OPENFILE);
      if(!sshc->sftp_handle) {
@@ -1971,7 +1930,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
          break;
        }
        else {
-          err = (int)(libssh2_sftp_last_error(sshc->sftp_session));
+          err = sftp_libssh2_last_error(sshc->sftp_session);
          failf(data, "Could not open remote file for reading: %s",
                sftp_libssh2_strerror(err));
          state(conn, SSH_SFTP_CLOSE);
@@ -1988,7 +1947,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
      LIBSSH2_SFTP_ATTRIBUTES attrs;

      rc = libssh2_sftp_stat_ex(sshc->sftp_session, sftp_scp->path,
-                                (unsigned int)strlen(sftp_scp->path),
+                                curlx_uztoui(strlen(sftp_scp->path)),
                                LIBSSH2_SFTP_STAT, &attrs);
      if(rc == LIBSSH2_ERROR_EAGAIN) {
        break;
@@ -2116,10 +2075,8 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
        }
        sshc->sftp_handle = NULL;
      }
-      if(sftp_scp) {
+      if(sftp_scp)
        Curl_safefree(sftp_scp->path);
-        sftp_scp->path = NULL;
-      }

      DEBUGF(infof(data, "SFTP DONE done\n"));

@@ -2163,7 +2120,6 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
      }

      Curl_safefree(sshc->homedir);
-      sshc->homedir = NULL;
      conn->data->state.most_recent_ftp_entrypath = NULL;

      state(conn, SSH_SESSION_DISCONNECT);
@@ -2388,7 +2344,6 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
      }

      Curl_safefree(sshc->homedir);
-      sshc->homedir = NULL;
      conn->data->state.most_recent_ftp_entrypath = NULL;

      state(conn, SSH_SESSION_FREE);
@@ -2831,7 +2786,6 @@ static CURLcode scp_disconnect(struct connectdata *conn, bool dead_connection)
  (void) dead_connection;

  Curl_safefree(conn->data->state.proto.ssh);
-  conn->data->state.proto.ssh = NULL;

  if(ssh->ssh_session) {
    /* only if there's a session still around to use! */
@@ -2864,10 +2818,8 @@ static CURLcode ssh_done(struct connectdata *conn, CURLcode status)
  else
    result = status;

-  if(sftp_scp) {
+  if(sftp_scp)
    Curl_safefree(sftp_scp->path);
-    sftp_scp->path = NULL;
-  }
  Curl_pgrsDone(conn);

  conn->data->req.keepon = 0; /* clear all bits */
@@ -2999,7 +2951,6 @@ static CURLcode sftp_disconnect(struct connectdata *conn, bool dead_connection)
  DEBUGF(infof(conn->data, "SSH DISCONNECT starts now\n"));

  Curl_safefree(conn->data->state.proto.ssh);
-  conn->data->state.proto.ssh = NULL;

  if(conn->proto.sshc.ssh_session) {
    /* only if there's a session still around to use! */
@@ -3156,12 +3107,11 @@ get_pathname(const char **cpp, char **path)

  fail:
    Curl_safefree(*path);
-    *path = NULL;
    return CURLE_QUOTE_ERROR;
 }


-static const char *sftp_libssh2_strerror(unsigned long err)
+static const char *sftp_libssh2_strerror(int err)
 {
  switch (err) {
    case LIBSSH2_FX_NO_SUCH_FILE:
--- a/lib/ssluse.c
+++ b/lib/ssluse.c
@@ -67,6 +67,7 @@
 #include <x509v3.h>
 #endif

+#include "warnless.h"
 #include "curl_memory.h"
 #include "non-ascii.h" /* for Curl_convert_from_utf8 prototype */

@@ -144,7 +145,7 @@
 static char global_passwd[64];
 #endif

-static int passwd_callback(char *buf, int num, int verify
+static int passwd_callback(char *buf, int num, int encrypting
 #ifdef HAVE_USERDATA_IN_PWD_CALLBACK
                           /* This was introduced in 0.9.4, we can set this
                              using SSL_CTX_set_default_passwd_cb_userdata()
@@ -153,12 +154,13 @@ static int passwd_callback(char *buf, int num, int verify
 #endif
                           )
 {
-  if(verify)
-    fprintf(stderr, "%s\n", buf);
-  else {
-    if(num > (int)strlen((char *)global_passwd)) {
-      strcpy(buf, global_passwd);
-      return (int)strlen(buf);
+  DEBUGASSERT(0 == encrypting);
+
+  if(!encrypting) {
+    int klen = curlx_uztosi(strlen((char *)global_passwd));
+    if(num > klen) {
+      memcpy(buf, global_passwd, klen+1);
+      return klen;
    }
  }
  return 0;
@@ -254,7 +256,7 @@ static int ossl_seed(struct SessionHandle *data)
      if(!area)
        return 3; /* out of memory */

-      len = (int)strlen(area);
+      len = curlx_uztosi(strlen(area));
      RAND_add(area, len, (len >> 1));

      free(area); /* now remove the random junk */
@@ -338,6 +340,8 @@ int cert_stuff(struct connectdata *conn,
      size_t len = strlen(data->set.str[STRING_KEY_PASSWD]);
      if(len < sizeof(global_passwd))
        memcpy(global_passwd, data->set.str[STRING_KEY_PASSWD], len+1);
+      else
+        global_passwd[0] = '\0';
 #else
      /*
       * We set the password in the callback userdata
@@ -1044,40 +1048,50 @@ static int asn1_output(const ASN1_UTCTIME *tm,
 * E.g.
 *  "foo.host.com" matches "*.host.com".
 *
- * We are a bit more liberal than RFC2818 describes in that we
- * accept multiple "*" in pattern (similar to what some other browsers do).
- * E.g.
- *  "abc.def.domain.com" should strickly not match "*.domain.com", but we
- *  don't consider "." to be important in CERT checking.
+ * We use the matching rule described in RFC6125, section 6.4.3.
+ * http://tools.ietf.org/html/rfc6125#section-6.4.3
 */
 #define HOST_NOMATCH 0
 #define HOST_MATCH   1

 static int hostmatch(const char *hostname, const char *pattern)
 {
-  for(;;) {
-    char c = *pattern++;
-
-    if(c == '\0')
-      return (*hostname ? HOST_NOMATCH : HOST_MATCH);
-
-    if(c == '*') {
-      c = *pattern;
-      if(c == '\0')      /* "*\0" matches anything remaining */
-        return HOST_MATCH;
-
-      while(*hostname) {
-        /* The only recursive function in libcurl! */
-        if(hostmatch(hostname++,pattern) == HOST_MATCH)
-          return HOST_MATCH;
-      }
-      break;
-    }
-
-    if(Curl_raw_toupper(c) != Curl_raw_toupper(*hostname++))
-      break;
+  const char *pattern_label_end, *pattern_wildcard, *hostname_label_end;
+  int wildcard_enabled;
+  size_t prefixlen, suffixlen;
+  pattern_wildcard = strchr(pattern, '*');
+  if(pattern_wildcard == NULL) {
+    return Curl_raw_equal(pattern, hostname) ? HOST_MATCH : HOST_NOMATCH;
  }
-  return HOST_NOMATCH;
+  /* We require at least 2 dots in pattern to avoid too wide wildcard
+     match. */
+  wildcard_enabled = 1;
+  pattern_label_end = strchr(pattern, '.');
+  if(pattern_label_end == NULL || strchr(pattern_label_end+1, '.') == NULL ||
+     pattern_wildcard > pattern_label_end ||
+     Curl_raw_nequal(pattern, "xn--", 4)) {
+    wildcard_enabled = 0;
+  }
+  if(!wildcard_enabled) {
+    return Curl_raw_equal(pattern, hostname) ? HOST_MATCH : HOST_NOMATCH;
+  }
+  hostname_label_end = strchr(hostname, '.');
+  if(hostname_label_end == NULL ||
+     !Curl_raw_equal(pattern_label_end, hostname_label_end)) {
+    return HOST_NOMATCH;
+  }
+  /* The wildcard must match at least one character, so the left-most
+     label of the hostname is at least as large as the left-most label
+     of the pattern. */
+  if(hostname_label_end - hostname < pattern_label_end - pattern) {
+    return HOST_NOMATCH;
+  }
+  prefixlen = pattern_wildcard - pattern;
+  suffixlen = pattern_label_end - (pattern_wildcard+1);
+  return Curl_raw_nequal(pattern, hostname, prefixlen) &&
+    Curl_raw_nequal(pattern_wildcard+1, hostname_label_end - suffixlen,
+                    suffixlen) ?
+    HOST_MATCH : HOST_NOMATCH;
 }

 static int
@@ -1252,7 +1266,7 @@ static CURLcode verifyhost(struct connectdata *conn,
        else /* not a UTF8 name */
          j = ASN1_STRING_to_UTF8(&peer_CN, tmp);

-        if(peer_CN && ((int)strlen((char *)peer_CN) != j)) {
+        if(peer_CN && (curlx_uztosi(strlen((char *)peer_CN)) != j)) {
          /* there was a terminating zero before the end of string, this
             cannot match and we return failure! */
          failf(data, "SSL: illegal cert name field");
@@ -1566,7 +1580,10 @@ ossl_connect_step1(struct connectdata *conn,
 #endif

 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
-  ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
+  /* unless the user explicitly ask to allow the protocol vulnerability we
+     use the work-around */
+  if(!conn->data->set.ssl_enable_beast)
+    ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
 #endif

  /* disable SSLv2 in the default case (i.e. allow SSLv3 and TLSv1) */
@@ -1786,6 +1803,7 @@ ossl_connect_step2(struct connectdata *conn, int sockindex)
                                 256 bytes long. */
      CURLcode rc;
      const char *cert_problem = NULL;
+      long lerr;

      connssl->connecting_state = ssl_connect_2; /* the connection failed,
                                                    we're not waiting for
@@ -1807,12 +1825,22 @@ ossl_connect_step2(struct connectdata *conn, int sockindex)
           SSL routines:
           SSL3_GET_SERVER_CERTIFICATE:
           certificate verify failed */
-        cert_problem = "SSL certificate problem, verify that the CA cert is"
-          " OK. Details:\n";
        rc = CURLE_SSL_CACERT;
+
+        lerr = SSL_get_verify_result(connssl->handle);
+        if(lerr != X509_V_OK) {
+          snprintf(error_buffer, sizeof(error_buffer),
+                   "SSL certificate problem: %s",
+                   X509_verify_cert_error_string(lerr));
+        }
+        else
+          cert_problem = "SSL certificate problem, verify that the CA cert is"
+            " OK.";
+
        break;
      default:
        rc = CURLE_SSL_CONNECT_ERROR;
+        SSL_strerror(errdetail, error_buffer, sizeof(error_buffer));
        break;
      }

@@ -1829,7 +1857,6 @@ ossl_connect_step2(struct connectdata *conn, int sockindex)
      }
      /* Could be a CERT problem */

-      SSL_strerror(errdetail, error_buffer, sizeof(error_buffer));
      failf(data, "%s%s", cert_problem ? cert_problem : "", error_buffer);
      return rc;
    }
--- a/lib/telnet.c
+++ b/lib/telnet.c
@@ -69,6 +69,7 @@
 #include "select.h"
 #include "strequal.h"
 #include "rawstr.h"
+#include "warnless.h"

 /* The last #include file should be: */
 #include "memdebug.h"
--- a/lib/transfer.c
+++ b/lib/transfer.c
@@ -1864,7 +1864,7 @@ CURLcode Curl_follow(struct SessionHandle *data,
     */
    if((data->set.httpreq == HTTPREQ_POST
        || data->set.httpreq == HTTPREQ_POST_FORM)
-       && !data->set.post301) {
+       && !(data->set.keep_post & CURL_REDIR_POST_301)) {
      infof(data,
            "Violate RFC 2616/10.3.2 and switch from POST to GET\n");
      data->set.httpreq = HTTPREQ_GET;
@@ -1892,7 +1892,7 @@ CURLcode Curl_follow(struct SessionHandle *data,
    */
    if((data->set.httpreq == HTTPREQ_POST
        || data->set.httpreq == HTTPREQ_POST_FORM)
-       && !data->set.post302) {
+       && !(data->set.keep_post & CURL_REDIR_POST_302)) {
      infof(data,
            "Violate RFC 2616/10.3.3 and switch from POST to GET\n");
      data->set.httpreq = HTTPREQ_GET;
@@ -1900,9 +1900,10 @@ CURLcode Curl_follow(struct SessionHandle *data,
    break;

  case 303: /* See Other */
-    /* Disable both types of POSTs, since doing a second POST when
-     * following isn't what anyone would want! */
-    if(data->set.httpreq != HTTPREQ_GET) {
+    /* Disable both types of POSTs, unless the user explicitely
+       asks for POST after POST */
+    if(data->set.httpreq != HTTPREQ_GET
+      && !(data->set.keep_post & CURL_REDIR_POST_303)) {
      data->set.httpreq = HTTPREQ_GET; /* enforce GET request */
      infof(data, "Disables POST, goes with %s\n",
            data->set.opt_no_body?"HEAD":"GET");
@@ -1924,7 +1925,7 @@ CURLcode Curl_follow(struct SessionHandle *data,
    break;
  }
  Curl_pgrsTime(data, TIMER_REDIRECT);
-  Curl_pgrsResetTimes(data);
+  Curl_pgrsResetTimesSizes(data);

  return CURLE_OK;
 #endif /* CURL_DISABLE_HTTP */
--- a/lib/url.c
+++ b/lib/url.c
@@ -105,6 +105,7 @@ int curl_win32_idn_to_ascii(const char *in, char **out);
 #include "rawstr.h"
 #include "warnless.h"
 #include "non-ascii.h"
+#include "inet_pton.h"

 /* And now for the protocols */
 #include "ftp.h"
@@ -124,6 +125,7 @@ int curl_win32_idn_to_ascii(const char *in, char **out);
 #include "socks.h"
 #include "curl_rtmp.h"
 #include "gopher.h"
+#include "http_proxy.h"

 #define _MPRINTF_REPLACE /* use our functions only */
 #include <curl/mprintf.h>
@@ -272,6 +274,12 @@ void Curl_freeset(struct SessionHandle * data)
  enum dupstring i;
  for(i=(enum dupstring)0; i < STRING_LAST; i++)
    Curl_safefree(data->set.str[i]);
+
+  if(data->change.referer_alloc) {
+    Curl_safefree(data->change.referer);
+    data->change.referer_alloc = FALSE;
+  }
+  data->change.referer = NULL;
 }

 static CURLcode setstropt(char **charp, char * s)
@@ -742,6 +750,13 @@ CURLcode Curl_init_userdefined(struct UserDefined *set)
  set->chunk_bgn      = ZERO_NULL;
  set->chunk_end      = ZERO_NULL;

+  /* tcp keepalives are disabled by default, but provide reasonable values for
+   * the interval and idle times.
+   */
+  set->tcp_keepalive = FALSE;
+  set->tcp_keepintvl = 60;
+  set->tcp_keepidle = 60;
+
  return res;
 }

@@ -805,6 +820,7 @@ CURLcode Curl_open(struct SessionHandle **curl)
       multi stack. */
  }

+
  if(res) {
    Curl_resolver_cleanup(data->state.resolver);
    if(data->state.headerbuff)
@@ -824,6 +840,7 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
 {
  char *argptr;
  CURLcode result = CURLE_OK;
+  long arg;
 #ifndef CURL_DISABLE_HTTP
  curl_off_t bigsize;
 #endif
@@ -833,12 +850,10 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
    data->set.dns_cache_timeout = va_arg(param, long);
    break;
  case CURLOPT_DNS_USE_GLOBAL_CACHE:
-  {
    /* remember we want this enabled */
-    long use_cache = va_arg(param, long);
-    data->set.global_dns_cache = (0 != use_cache)?TRUE:FALSE;
-  }
-  break;
+    arg = va_arg(param, long);
+    data->set.global_dns_cache = (0 != arg)?TRUE:FALSE;
+    break;
  case CURLOPT_SSL_CIPHER_LIST:
    /* set a list of cipher we want to use in the SSL connection */
    result = setstropt(&data->set.str[STRING_SSL_CIPHER_LIST],
@@ -1097,12 +1112,12 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
     * CURL_REDIR_GET_ALL - POST is changed to GET after 301 and 302
     * CURL_REDIR_POST_301 - POST is kept as POST after 301
     * CURL_REDIR_POST_302 - POST is kept as POST after 302
-     * CURL_REDIR_POST_ALL - POST is kept as POST after 301 and 302
+     * CURL_REDIR_POST_303 - POST is kept as POST after 303
+     * CURL_REDIR_POST_ALL - POST is kept as POST after 301, 302 and 303
     * other - POST is kept as POST after 301 and 302
     */
-    long postRedir = va_arg(param, long);
-    data->set.post301 = (postRedir & CURL_REDIR_POST_301)?TRUE:FALSE;
-    data->set.post302 = (postRedir & CURL_REDIR_POST_302)?TRUE:FALSE;
+    int postRedir = curlx_sltosi(va_arg(param, long));
+    data->set.keep_post = postRedir & CURL_REDIR_POST_ALL;
  }
  break;

@@ -1383,7 +1398,14 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
     * Set HTTP Authentication type BITMASK.
     */
  {
-    long auth = va_arg(param, long);
+    int bitcheck;
+    bool authbits;
+    unsigned long auth = va_arg(param, unsigned long);
+
+    if(auth == CURLAUTH_NONE) {
+      data->set.httpauth = auth;
+      break;
+    }

    /* the DIGEST_IE bit is only used to set a special marker, for all the
       rest we need to handle it as normal DIGEST */
@@ -1405,7 +1427,17 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
    auth &= ~CURLAUTH_GSSNEGOTIATE; /* no GSS-Negotiate without GSSAPI or
                                       WINDOWS_SSPI */
 #endif
-    if(!auth)
+
+    /* check if any auth bit lower than CURLAUTH_ONLY is still set */
+    bitcheck = 0;
+    authbits = FALSE;
+    while(bitcheck < 31) {
+      if(auth & (1UL << bitcheck++)) {
+        authbits = TRUE;
+        break;
+      }
+    }
+    if(!authbits)
      return CURLE_NOT_BUILT_IN; /* no supported types left! */

    data->set.httpauth = auth;
@@ -1447,7 +1479,14 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
     * Set HTTP Authentication type BITMASK.
     */
  {
-    long auth = va_arg(param, long);
+    int bitcheck;
+    bool authbits;
+    unsigned long auth = va_arg(param, unsigned long);
+
+    if(auth == CURLAUTH_NONE) {
+      data->set.proxyauth = auth;
+      break;
+    }

    /* the DIGEST_IE bit is only used to set a special marker, for all the
       rest we need to handle it as normal DIGEST */
@@ -1468,7 +1507,17 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
    auth &= ~CURLAUTH_GSSNEGOTIATE; /* no GSS-Negotiate without GSSAPI or
                                       WINDOWS_SSPI */
 #endif
-    if(!auth)
+
+    /* check if any auth bit lower than CURLAUTH_ONLY is still set */
+    bitcheck = 0;
+    authbits = FALSE;
+    while(bitcheck < 31) {
+      if(auth & (1UL << bitcheck++)) {
+        authbits = TRUE;
+        break;
+      }
+    }
+    if(!authbits)
      return CURLE_NOT_BUILT_IN; /* no supported types left! */

    data->set.proxyauth = auth;
@@ -2175,6 +2224,12 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
     */
    data->set.use_ssl = (curl_usessl)va_arg(param, long);
    break;
+
+  case CURLOPT_SSL_OPTIONS:
+    arg = va_arg(param, long);
+    data->set.ssl_enable_beast = arg&CURLSSLOPT_ALLOW_BEAST?TRUE:FALSE;
+    break;
+
 #endif
  case CURLOPT_FTPSSLAUTH:
    /*
@@ -2383,6 +2438,11 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
                       va_arg(param, char *));
    break;

+  case CURLOPT_MAIL_AUTH:
+    result = setstropt(&data->set.str[STRING_MAIL_AUTH],
+                       va_arg(param, char *));
+    break;
+
  case CURLOPT_MAIL_RCPT:
    /* get a list of mail recipients */
    data->set.mail_rcpt = va_arg(param, struct curl_slist *);
@@ -2539,6 +2599,16 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
    result = Curl_set_dns_servers(data, va_arg(param, char *));
    break;

+  case CURLOPT_TCP_KEEPALIVE:
+    data->set.tcp_keepalive = (0 != va_arg(param, long))?TRUE:FALSE;
+    break;
+  case CURLOPT_TCP_KEEPIDLE:
+    data->set.tcp_keepidle = va_arg(param, long);
+    break;
+  case CURLOPT_TCP_KEEPINTVL:
+    data->set.tcp_keepintvl = va_arg(param, long);
+    break;
+
  default:
    /* unknown tag and its companion, just ignore: */
    result = CURLE_UNKNOWN_OPTION;
@@ -3351,13 +3421,18 @@ CURLcode Curl_protocol_connect(struct connectdata *conn,
  Curl_verboseconnect(conn);

  if(!conn->bits.protoconnstart) {
+
+    /* Set start time here for timeout purposes in the connect procedure, it
+       is later set again for the progress meter purpose */
+    conn->now = Curl_tvnow();
+
+    result = Curl_proxy_connect(conn);
+    if(result)
+      return result;
+
    if(conn->handler->connect_it) {
      /* is there a protocol-specific connect() procedure? */

-      /* Set start time here for timeout purposes in the connect procedure, it
-         is later set again for the progress meter purpose */
-      conn->now = Curl_tvnow();
-
      /* Call the protocol-specific connect function */
      result = conn->handler->connect_it(conn, protocol_done);
    }
@@ -4195,20 +4270,16 @@ static CURLcode parse_proxy(struct SessionHandle *data,

      if(CURLE_OK == res) {
        conn->bits.proxy_user_passwd = TRUE; /* enable it */
-        atsign = strdup(atsign+1); /* the right side of the @-letter */
+        atsign++; /* the right side of the @-letter */

-        if(atsign) {
-          free(proxy); /* free the former proxy string */
+        if(atsign)
          proxy = proxyptr = atsign; /* now use this instead */
-        }
        else
          res = CURLE_OUT_OF_MEMORY;
      }

-      if(res) {
-        free(proxy); /* free the allocated proxy string */
+      if(res)
        return res;
-      }
    }
  }

@@ -4242,6 +4313,12 @@ static CURLcode parse_proxy(struct SessionHandle *data,
    conn->port = strtol(prox_portno, NULL, 10);
  }
  else {
+    if(proxyptr[0]=='/')
+      /* If the first character in the proxy string is a slash, fail
+         immediately. The following code will otherwise clear the string which
+         will lead to code running as if no proxy was set! */
+      return CURLE_COULDNT_RESOLVE_PROXY;
+
    /* without a port number after the host name, some people seem to use
       a slash so we strip everything from the first slash */
    atsign = strchr(proxyptr, '/');
@@ -4258,7 +4335,6 @@ static CURLcode parse_proxy(struct SessionHandle *data,
  conn->proxy.rawalloc = strdup(proxyptr);
  conn->proxy.name = conn->proxy.rawalloc;

-  free(proxy);
  if(!conn->proxy.rawalloc)
    return CURLE_OUT_OF_MEMORY;

@@ -4420,8 +4496,19 @@ static CURLcode parse_remote_port(struct SessionHandle *data,
        portptr = NULL; /* no port number available */
    }
  }
-  else
+  else {
+#ifdef ENABLE_IPV6
+    struct in6_addr in6;
+    if(Curl_inet_pton(AF_INET6, conn->host.name, &in6) > 0) {
+      /* This is a numerical IPv6 address, meaning this is a wrongly formatted
+         URL */
+      failf(data, "IPv6 numerical address used in URL without brackets");
+      return CURLE_URL_MALFORMAT;
+    }
+#endif
+
    portptr = strrchr(conn->host.name, ':');
+  }

  if(data->set.use_port && data->state.allow_port) {
    /* if set, we use this and ignore the port possibly given in the URL */
@@ -4889,8 +4976,9 @@ static CURLcode create_conn(struct SessionHandle *data,
  if(proxy) {
    result = parse_proxy(data, conn, proxy);

-    /* parse_proxy has freed the proxy string, so don't try to use it again */
-    if(result != CURLE_OK)
+    free(proxy); /* parse_proxy copies the proxy string */
+
+    if(result)
      return result;

    if((conn->proxytype == CURLPROXY_HTTP) ||
--- a/lib/urldata.h
+++ b/lib/urldata.h
@@ -112,7 +112,7 @@
 #endif

 #ifdef USE_CYASSL
-#include <openssl/ssl.h>
+#include <cyassl/openssl/ssl.h>
 #endif

 #ifdef USE_NSS
@@ -261,6 +261,7 @@ struct ssl_connect_data {
  x509_cert clicert;
  x509_crl crl;
  rsa_context rsa;
+  ssl_connect_state connecting_state;
 #endif /* USE_POLARSSL */
 #ifdef USE_CYASSL
  SSL_CTX* ctx;
@@ -271,10 +272,8 @@ struct ssl_connect_data {
  PRFileDesc *handle;
  char *client_nickname;
  struct SessionHandle *data;
-#ifdef HAVE_PK11_CREATEGENERICOBJECT
  struct curl_llist *obj_list;
  PK11GenericObject *obj_clicert;
-#endif
 #endif /* USE_NSS */
 #ifdef USE_QSOSSL
  SSLHandle *handle;
@@ -422,8 +421,6 @@ struct ConnectBits {
                         This is implicit when SSL-protocols are used through
                         proxies, but can also be enabled explicitly by
                         apps */
-  bool tunnel_connecting; /* TRUE while we're still waiting for a proxy CONNECT
-                           */
  bool authneg;       /* TRUE when the auth phase has started, which means
                         that we are creating a request with an auth header,
                         but it is not the final request in the auth
@@ -964,6 +961,12 @@ struct connectdata {
  unsigned short localport;
  int localportrange;

+  /* tunnel as in tunnel through a HTTP proxy with CONNECT */
+  enum {
+    TUNNEL_INIT,    /* init/default/no tunnel state */
+    TUNNEL_CONNECT, /* CONNECT has been sent off */
+    TUNNEL_COMPLETE /* CONNECT response received completely */
+  } tunnel_state[2]; /* two separate ones to allow FTP */
 };

 /* The end of connectdata. */
@@ -983,8 +986,8 @@ struct PureInfo {
                     thus made the document NOT get fetched */
  long header_size;  /* size of read header(s) in bytes */
  long request_size; /* the amount of bytes sent in the request(s) */
-  long proxyauthavail; /* what proxy auth types were announced */
-  long httpauthavail;  /* what host auth types were announced */
+  unsigned long proxyauthavail; /* what proxy auth types were announced */
+  unsigned long httpauthavail;  /* what host auth types were announced */
  long numconnects; /* how many new connection did libcurl created */
  char *contenttype; /* the content type of the object */
  char *wouldredirect; /* URL this would've been redirected to if asked to */
@@ -1086,11 +1089,11 @@ typedef enum {
 #define MAX_CURL_PASSWORD_LENGTH_TXT "255"

 struct auth {
-  long want;  /* Bitmask set to the authentication methods wanted by the app
-                 (with CURLOPT_HTTPAUTH or CURLOPT_PROXYAUTH). */
-  long picked;
-  long avail; /* bitmask for what the server reports to support for this
-                 resource */
+  unsigned long want;  /* Bitmask set to the authentication methods wanted by
+                          app (with CURLOPT_HTTPAUTH or CURLOPT_PROXYAUTH). */
+  unsigned long picked;
+  unsigned long avail; /* Bitmask for what the server reports to support for
+                          this resource */
  bool done;  /* TRUE when the auth phase is done and ready to do the *actual*
                 request */
  bool multi; /* TRUE if this is not yet authenticated but within the auth
@@ -1335,6 +1338,7 @@ enum dupstring {
  STRING_SOCKS5_GSSAPI_SERVICE,  /* GSSAPI service name */
 #endif
  STRING_MAIL_FROM,
+  STRING_MAIL_AUTH,

 #ifdef USE_TLS_SRP
  STRING_TLSAUTH_USERNAME,     /* TLS auth <username> */
@@ -1357,14 +1361,14 @@ struct UserDefined {
  void *writeheader; /* write the header to this if non-NULL */
  void *rtp_out;     /* write RTP to this if non-NULL */
  long use_port;     /* which port to use (when not using default) */
-  long httpauth;     /* what kind of HTTP authentication to use (bitmask) */
-  long proxyauth;    /* what kind of proxy authentication to use (bitmask) */
+  unsigned long httpauth;  /* kind of HTTP authentication to use (bitmask) */
+  unsigned long proxyauth; /* kind of proxy authentication to use (bitmask) */
  long followlocation; /* as in HTTP Location: */
  long maxredirs;    /* maximum no. of http(s) redirects to follow, set to -1
                        for infinity */
-  bool post301;      /* Obey RFC 2616/10.3.2 and keep POSTs as POSTs after a
-                        301 */
-  bool post302;      /* keep POSTs as POSTs after a 302 */
+
+  int keep_post;     /* keep POSTs as POSTs after a 30x request; each
+                        bit represents a request, from 301 to 303 */
  bool free_referer; /* set TRUE if 'referer' points to a string we
                        allocated */
  void *postfields;  /* if POST, set the fields' values here */
@@ -1508,6 +1512,8 @@ struct UserDefined {
  bool ftp_skip_ip;      /* skip the IP address the FTP server passes on to
                            us */
  bool connect_only;     /* make connection, let application use the socket */
+  bool ssl_enable_beast; /* especially allow this flaw for interoperability's
+                            sake*/
  long ssh_auth_types;   /* allowed SSH auth types */
  bool http_te_skip;     /* pass the raw body data to the user, even when
                            transfer-encoded (chunked, compressed) */
@@ -1539,6 +1545,10 @@ struct UserDefined {

  long gssapi_delegation; /* GSSAPI credential delegation, see the
                             documentation of CURLOPT_GSSAPI_DELEGATION */
+
+  bool tcp_keepalive;    /* use TCP keepalives */
+  long tcp_keepidle;     /* seconds in idle before sending keepalive probe */
+  long tcp_keepintvl;    /* seconds between TCP keepalive probes */
 };

 struct Names {
--- a/lib/warnless.c
+++ b/lib/warnless.c
@@ -131,6 +131,7 @@ unsigned short curlx_ultous(unsigned long ulnum)
 #  pragma warning(disable:810) /* conversion may lose significant bits */
 #endif

+  DEBUGASSERT(ulnum <= (unsigned long) CURL_MASK_USHORT);
  return (unsigned short)(ulnum & (unsigned long) CURL_MASK_USHORT);

 #ifdef __INTEL_COMPILER
@@ -149,6 +150,7 @@ unsigned char curlx_ultouc(unsigned long ulnum)
 #  pragma warning(disable:810) /* conversion may lose significant bits */
 #endif

+  DEBUGASSERT(ulnum <= (unsigned long) CURL_MASK_UCHAR);
  return (unsigned char)(ulnum & (unsigned long) CURL_MASK_UCHAR);

 #ifdef __INTEL_COMPILER
@@ -156,6 +158,25 @@ unsigned char curlx_ultouc(unsigned long ulnum)
 #endif
 }

+/*
+** unsigned long to signed int
+*/
+
+int curlx_ultosi(unsigned long ulnum)
+{
+#ifdef __INTEL_COMPILER
+#  pragma warning(push)
+#  pragma warning(disable:810) /* conversion may lose significant bits */
+#endif
+
+  DEBUGASSERT(ulnum <= (unsigned long) CURL_MASK_SINT);
+  return (int)(ulnum & (unsigned long) CURL_MASK_SINT);
+
+#ifdef __INTEL_COMPILER
+#  pragma warning(pop)
+#endif
+}
+
 /*
 ** unsigned size_t to signed int
 */
@@ -167,6 +188,7 @@ int curlx_uztosi(size_t uznum)
 #  pragma warning(disable:810) /* conversion may lose significant bits */
 #endif

+  DEBUGASSERT(uznum <= (size_t) CURL_MASK_SINT);
  return (int)(uznum & (size_t) CURL_MASK_SINT);

 #ifdef __INTEL_COMPILER
@@ -185,6 +207,7 @@ unsigned long curlx_uztoul(size_t uznum)
 # pragma warning(disable:810) /* conversion may lose significant bits */
 #endif

+  DEBUGASSERT(uznum <= (size_t) CURL_MASK_ULONG);
  return (unsigned long)(uznum & (size_t) CURL_MASK_ULONG);

 #ifdef __INTEL_COMPILER
@@ -192,6 +215,25 @@ unsigned long curlx_uztoul(size_t uznum)
 #endif
 }

+/*
+** unsigned size_t to unsigned int
+*/
+
+unsigned int curlx_uztoui(size_t uznum)
+{
+#ifdef __INTEL_COMPILER
+# pragma warning(push)
+# pragma warning(disable:810) /* conversion may lose significant bits */
+#endif
+
+  DEBUGASSERT(uznum <= (size_t) CURL_MASK_UINT);
+  return (unsigned int)(uznum & (size_t) CURL_MASK_UINT);
+
+#ifdef __INTEL_COMPILER
+# pragma warning(pop)
+#endif
+}
+
 /*
 ** signed long to signed int
 */
@@ -204,6 +246,7 @@ int curlx_sltosi(long slnum)
 #endif

  DEBUGASSERT(slnum >= 0);
+  DEBUGASSERT((unsigned long) slnum <= (unsigned long) CURL_MASK_SINT);
  return (int)(slnum & (long) CURL_MASK_SINT);

 #ifdef __INTEL_COMPILER
@@ -223,6 +266,7 @@ unsigned int curlx_sltoui(long slnum)
 #endif

  DEBUGASSERT(slnum >= 0);
+  DEBUGASSERT((unsigned long) slnum <= (unsigned long) CURL_MASK_UINT);
  return (unsigned int)(slnum & (long) CURL_MASK_UINT);

 #ifdef __INTEL_COMPILER
@@ -242,6 +286,7 @@ unsigned short curlx_sltous(long slnum)
 #endif

  DEBUGASSERT(slnum >= 0);
+  DEBUGASSERT((unsigned long) slnum <= (unsigned long) CURL_MASK_USHORT);
  return (unsigned short)(slnum & (long) CURL_MASK_USHORT);

 #ifdef __INTEL_COMPILER
@@ -260,6 +305,7 @@ ssize_t curlx_uztosz(size_t uznum)
 #  pragma warning(disable:810) /* conversion may lose significant bits */
 #endif

+  DEBUGASSERT(uznum <= (size_t) CURL_MASK_SSIZE_T);
  return (ssize_t)(uznum & (size_t) CURL_MASK_SSIZE_T);

 #ifdef __INTEL_COMPILER
@@ -286,6 +332,26 @@ size_t curlx_sotouz(curl_off_t sonum)
 #endif
 }

+/*
+** signed ssize_t to signed int
+*/
+
+int curlx_sztosi(ssize_t sznum)
+{
+#ifdef __INTEL_COMPILER
+#  pragma warning(push)
+#  pragma warning(disable:810) /* conversion may lose significant bits */
+#endif
+
+  DEBUGASSERT(sznum >= 0);
+  DEBUGASSERT((size_t) sznum <= (size_t) CURL_MASK_SINT);
+  return (int)(sznum & (ssize_t) CURL_MASK_SINT);
+
+#ifdef __INTEL_COMPILER
+#  pragma warning(pop)
+#endif
+}
+
 /*
 ** signed int to unsigned size_t
 */
--- a/lib/warnless.h
+++ b/lib/warnless.h
@@ -26,10 +26,14 @@ unsigned short curlx_ultous(unsigned long ulnum);

 unsigned char curlx_ultouc(unsigned long ulnum);

+int curlx_ultosi(unsigned long ulnum);
+
 int curlx_uztosi(size_t uznum);

 unsigned long curlx_uztoul(size_t uznum);

+unsigned int curlx_uztoui(size_t uznum);
+
 int curlx_sltosi(long slnum);

 unsigned int curlx_sltoui(long slnum);
@@ -40,6 +44,8 @@ ssize_t curlx_uztosz(size_t uznum);

 size_t curlx_sotouz(curl_off_t sonum);

+int curlx_sztosi(ssize_t sznum);
+
 size_t curlx_sitouz(int sinum);

 #if defined(__INTEL_COMPILER) && defined(__unix__)
--- a/m4/curl-compilers.m4
+++ b/m4/curl-compilers.m4
@@ -5,7 +5,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+# Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -21,7 +21,7 @@
 #***************************************************************************

 # File version for 'aclocal' use. Keep it a single number.
-# serial 58
+# serial 61


 dnl CURL_CHECK_COMPILER
@@ -161,6 +161,7 @@ AC_DEFUN([CURL_CHECK_COMPILER_GNU_C], [
    flags_opt_all="-O -O0 -O1 -O2 -O3 -Os"
    flags_opt_yes="-O2"
    flags_opt_off="-O0"
+    CURL_CHECK_DEF([_WIN32], [], [silent])
  else
    AC_MSG_RESULT([no])
  fi
@@ -977,6 +978,14 @@ AC_DEFUN([CURL_SET_COMPILER_WARNING_OPTS], [
            tmp_CFLAGS="$tmp_CFLAGS -Wconversion -Wno-sign-conversion -Wvla"
          fi
          #
+          dnl Only gcc 4.5 or later
+          if test "$compiler_num" -ge "405"; then
+            dnl Only windows targets
+            if test "$curl_cv_have_def__WIN32" = "yes"; then
+              tmp_CFLAGS="$tmp_CFLAGS -Wno-pedantic-ms-format"
+            fi
+          fi
+          #
        fi
        #
        dnl Do not issue warnings for code in system include paths.
@@ -1375,6 +1384,114 @@ AC_DEFUN([CURL_CHECK_COMPILER_STRUCT_MEMBER_SIZE], [
 ])


+dnl CURL_CHECK_COMPILER_SYMBOL_HIDING
+dnl -------------------------------------------------
+dnl Verify if compiler supports hiding library internal symbols, setting
+dnl shell variable supports_symbol_hiding value as appropriate, as well as
+dnl variables symbol_hiding_CFLAGS and symbol_hiding_EXTERN when supported.
+
+AC_DEFUN([CURL_CHECK_COMPILER_SYMBOL_HIDING], [
+  AC_REQUIRE([CURL_CHECK_COMPILER])dnl
+  AC_BEFORE([$0],[CURL_CONFIGURE_SYMBOL_HIDING])dnl
+  AC_MSG_CHECKING([if compiler supports hiding library internal symbols])
+  supports_symbol_hiding="no"
+  symbol_hiding_CFLAGS=""
+  symbol_hiding_EXTERN=""
+  tmp_CFLAGS=""
+  tmp_EXTERN=""
+  case "$compiler_id" in
+    CLANG)
+      dnl All versions of clang support -fvisibility=
+      tmp_EXTERN="__attribute__ ((__visibility__ (\"default\")))"
+      tmp_CFLAGS="-fvisibility=hidden"
+      supports_symbol_hiding="yes"
+      ;;
+    GNU_C)
+      dnl Only gcc 3.4 or later
+      if test "$compiler_num" -ge "304"; then
+        if $CC --help --verbose 2>&1 | grep fvisibility= > /dev/null ; then
+          tmp_EXTERN="__attribute__ ((__visibility__ (\"default\")))"
+          tmp_CFLAGS="-fvisibility=hidden"
+          supports_symbol_hiding="yes"
+        fi
+      fi
+      ;;
+    INTEL_UNIX_C)
+      dnl Only icc 9.0 or later
+      if test "$compiler_num" -ge "900"; then
+        if $CC --help --verbose 2>&1 | grep fvisibility= > /dev/null ; then
+          tmp_save_CFLAGS="$CFLAGS"
+          CFLAGS="$CFLAGS -fvisibility=hidden"
+          AC_LINK_IFELSE([
+            AC_LANG_PROGRAM([[
+#             include <stdio.h>
+            ]],[[
+              printf("icc fvisibility bug test");
+            ]])
+          ],[
+            tmp_EXTERN="__attribute__ ((__visibility__ (\"default\")))"
+            tmp_CFLAGS="-fvisibility=hidden"
+            supports_symbol_hiding="yes"
+          ])
+          CFLAGS="$tmp_save_CFLAGS"
+        fi
+      fi
+      ;;
+    SUNPRO_C)
+      if $CC 2>&1 | grep flags >/dev/null && $CC -flags | grep xldscope= >/dev/null ; then
+        tmp_EXTERN="__global"
+        tmp_CFLAGS="-xldscope=hidden"
+        supports_symbol_hiding="yes"
+      fi
+      ;;
+  esac
+  if test "$supports_symbol_hiding" = "yes"; then
+    tmp_save_CFLAGS="$CFLAGS"
+    CFLAGS="$tmp_save_CFLAGS $tmp_CFLAGS"
+    squeeze CFLAGS
+    AC_COMPILE_IFELSE([
+      AC_LANG_PROGRAM([[
+        $tmp_EXTERN char *dummy(char *buff);
+        char *dummy(char *buff)
+        {
+         if(buff)
+           return ++buff;
+         else
+           return buff;
+        }
+      ]],[[
+        char b[16];
+        char *r = dummy(&b[0]);
+        if(r)
+          return (int)*r;
+      ]])
+    ],[
+      supports_symbol_hiding="yes"
+      if test -f conftest.err; then
+        grep 'visibility' conftest.err >/dev/null
+        if test "$?" -eq "0"; then
+          supports_symbol_hiding="no"
+        fi
+      fi
+    ],[
+      supports_symbol_hiding="no"
+      echo " " >&6
+      sed 's/^/cc-src: /' conftest.$ac_ext >&6
+      sed 's/^/cc-err: /' conftest.err >&6
+      echo " " >&6
+    ])
+    CFLAGS="$tmp_save_CFLAGS"
+  fi
+  if test "$supports_symbol_hiding" = "yes"; then
+    AC_MSG_RESULT([yes])
+    symbol_hiding_CFLAGS="$tmp_CFLAGS"
+    symbol_hiding_EXTERN="$tmp_EXTERN"
+  else
+    AC_MSG_RESULT([no])
+  fi
+])
+
+
 dnl CURL_VAR_MATCH (VARNAME, VALUE)
 dnl -------------------------------------------------
 dnl Verifies if shell variable VARNAME contains VALUE.
--- a/Show More
+++ b/Show More