Introducing the curl bug bounty program on hackerone. We now recommend
filing security issues directly in the hackerone ticket system which
only is readable to curl security team members.

Assisted-by: Daniel Gustafsson

Closes #3488

RFC 4616 specifies the authzid is optional in the client authentication
message and that the server will derive the authorisation identity
(authzid) from the authentication identity (authcid) when not specified
by the client.

Follow-up to 76b63489 which renamed logfile as curl_dbg_logfile.

Ref: https://github.com/curl/curl/commit/76b6348#r33259088

Follow up to 762a292f.

... and disconnect too old ones instead of trying to reuse.

Default max age is set to 118 seconds.

Ref: #3722
Closes #3782

ALTSVC requires Curl_get_line which is defined in lib/cookie.c inside a #if
check of HTTP and COOKIES. That makes Curl_get_line undefined if COOKIES is
disabled. Fix by splitting out the function into a separate file which can
be included where needed.

Closes #3717
Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>

which basically just makes sure LOGOUT is *not* issued on disconnect

Since the connection has been used by the "outside" we don't know the
state of it anymore and curl should not use it anymore.

Bug: https://curl.haxx.se/mail/lib-2019-04/0052.html

Closes #3795

The list of names must be in sync with the defined states in the header
file!

Fixes #3768
Closes #3785

.. because functionality may be affected if the versions differ.

This commit implements TODO 18.7 "warning if curl version is not in sync
with libcurl version".

Ref: https://github.com/curl/curl/blob/curl-7_64_1/docs/TODO#L1028-L1033

Closes https://github.com/curl/curl/pull/3774

Following 28f826b3 to return CURLE_OK instead of numeric 0.

Make sure to run curl_global_cleanup() when shutting down the test
suite to release any resources allocated in the SSL setup. This is
clearly visible when running tests with PolarSSL where the thread
lock calloc() memory which isn't released when not running cleanup.
Below is an excerpt from the autobuild logs:

  ==12368== 96 bytes in 1 blocks are possibly lost in loss record 1 of 2
  ==12368== at 0x4837B65: calloc (vg_replace_malloc.c:752)
  ==12368== by 0x11A76E: curl_dbg_calloc (memdebug.c:205)
  ==12368== by 0x145CDF: Curl_polarsslthreadlock_thread_setup
                         (polarssl_threadlock.c:54)
  ==12368== by 0x145B37: Curl_polarssl_init (polarssl.c:865)
  ==12368== by 0x14129D: Curl_ssl_init (vtls.c:171)
  ==12368== by 0x118B4C: global_init (easy.c:158)
  ==12368== by 0x118BF5: curl_global_init (easy.c:221)
  ==12368== by 0x118D0B: curl_easy_init (easy.c:299)
  ==12368== by 0x114E96: test (lib1906.c:32)
  ==12368== by 0x115495: main (first.c:174)

Closes #3783
Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

No need to build it from source anymore.

Closes https://github.com/curl/curl/pull/3779

This makes building libpsl and libidn2 from source unnecessary and
removes the need for the autopoint and libunistring-dev packages.

Closes https://github.com/curl/curl/pull/3779

... without a $srcdir prefix. Triggered by the failures in several
autobuilds.

Closes #3781

Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Mark global variables static to avoid compiler warning in Clang when
using -Wmissing-variable-declarations.

Closes #3778
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

The indentation from 211d5329 and 57d6d253 was a little strange as
parts didn't align correctly, uses 4 spaces rather than 2. Checked
the indentation of the original source so it aligns, albeit, using
curl style.

Xenial comes with more up-to-date software versions and more available
packages, some of which we currently build from source. Unfortunately,
some builds would fail with Xenial because of assertion failures in
Valgrind when using OpenSSL, so leave these at Trusty.

Closes https://github.com/curl/curl/pull/3777

Make all SOCKS tests use socksd instead of ssh.

Closes #3752

To aid debugging better.

Commit 9081014c fixed most of the confusing issues between scope id and
scope however 844896d0 added bad limits checking assuming that the scope
is being set and not the scope id.

I have fixed the documentation so it all refers to scope ids.

In addition Curl_if2ip refered to the scope id as remote_scope_id which
is incorrect, so I renamed it to local_scope_id.

Adjusted-by: Daniel Stenberg

Closes #3655
Closes #3765
Fixes #3713

Only allow well formed decimal numbers in the input.

Document that the number MUST be between 1 and 65535.

Add tests to test 1560 to verify the above.

Ref: https://github.com/curl/curl/issues/3753
Closes #3762

- Remove the lines in winbuild/Makefile.vc that generate an error with
  multiple SSL backends.

- Add /DCURL_WITH_MULTI_SSL in winbuild/MakefileBuild.vc if multiple SSL
  backends are set.

Closes https://github.com/curl/curl/pull/3772

Since the mesalink build started to fail on travis, even though we build
a fixed release version, we disable it to prevent it from blocking
progress.

Closes #3767

Without this, detecting and avoid reusing a closed TLS connection
(without a previous GOAWAY) when doing HTTP/2 is tricky.

Reported-by: Tom van der Woerdt
Fixes #3750
Closes #3763

Functionally this doesn't change anything as we still use the username
for both the authorisation identity and the authentication identity.

Closes #3757