CURL 7.66 released: tool to transfer data from or to a server

curl is a tool to transfer data from or to a server, using one of the supported protocols (HTTP, HTTPS, FTP, FTPS, SCP, SFTP, TFTP, DICT, TELNET, LDAP or FILE). The command is designed to work without user interaction.
curl offers proxy support, user authentication, FTP uploading, HTTP posting, SSL connections, cookies, file transfer resume, Metalink, and many other features.

CURL 7.66 released.

Changelog

Changes:

• CURLINFO_RETRY_AFTER: parse the Retry-After header value
• HTTP3: initial (experimental still not working) support
• curl: –sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
• curl: support parallel transfers with -Z
• curl_multi_poll: a sister to curl_multi_wait() that waits more
• sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID

Bugfixes:

• CVE-2019-5481: FTP-KRB double-free
• CVE-2019-5482: TFTP small blocksize heap buffer overflow
• CI: remove duplicate configure flag for LGTM.com
• CMake: remove needless newlines at end of gss variables
• CMake: use platform dependent name for dlopen() library
• CURLINFO docs: mention that in redirects times are added
• CURLOPT_ALTSVC.3: use a “” file name to not load from a file
• CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
• CURLOPT_HEADERFUNCTION.3: clarify
• CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
• CURLOPT_READFUNCTION.3: provide inline example
• CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
• Curl_addr2string: take an addrlen argument too
• Curl_fillreadbuffer: avoid double-free trailer buf on error
• HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
• alt-svc: add protocol version selection masking
• alt-svc: fix removal of expired cache entry
• alt-svc: make it use h3-22 with ngtcp2 as well
• alt-svc: more liberal ALPN name parsing
• alt-svc: send Alt-Used: in redirected requests
• alt-svc: with quiche, use the quiche h3 alpn string
• appveyor: pass on -k to make
• asyn-thread: create a socketpair to wait on
• build-openssl: fix build with Visual Studio 2019
• cleanup: move functions out of url.c and make them static
• cleanup: remove the ‘numsocks’ argument used in many places
• configure: avoid undefined check_for_ca_bundle
• curl.h: add CURL_HTTP_VERSION_3 to the version enum
• curl.h: fix outdated comment
• curl: cap the maximum allowed values for retry time arguments
• curl: handle a libcurl build without netrc support
• curl: make use of CURLINFO_RETRY_AFTER when retrying
• curl: remove outdated comment
• curl: use .curlrc (with a dot) on Windows
• curl: use CURLINFO_PROTOCOL to check for HTTP(s)
• curl_global_init_mem.3: mention it was added in 7.12.0
• curl_version: bump string buffer size to 250
• curl_version_info.3: mentioned ALTSVC and HTTP3
• curl_version_info: offer quic (and h3) library info
• curl_version_info: provide nghttp2 details
• defines: avoid underscore-prefixed defines
• docs/ALTSVC: remove what works and the experimental explanation
• docs/EXPERIMENTAL: explain what it means and what’s experimental now
• docs/MANUAL.md: converted to markdown from plain text
• docs/examples/curlx: fix errors
• docs: s/curl_debug/curl_dbg_debug in comments and docs
• easy: resize receive buffer on easy handle reset
• examples: Avoid reserved names in hiperfifo examples
• examples: add http3.c, altsvc.c and http3-present.c
• getenv: support up to 4K environment variable contents on windows
• http09: disable HTTP/0.9 by default in both tool and library
• http2: when marked for closure and wanted to close == OK
• http2_recv: trigger another read when the last data is returned
• http: fix use of credentials from URL when using HTTP proxy
• http_negotiate: improve handling of gss_init_sec_context() failures
• md4: Use our own MD4 when no crypto libraries are available
• multi: call detach_connection before Curl_disconnect
• netrc: make the code try “.netrc” on Windows
• nss: use TLSv1.3 as default if supported
• openssl: build warning free with boringssl
• openssl: use SSL_CTX_set_<min|max>_proto_version() when available</min|max>
• plan9: add support for running on Plan 9
• progress: reset download/uploaded counter between transfers
• readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
• scp: fix directory name length used in memcpy
• smb: init *msg to NULL in smb_send_and_recv()
• smtp: check for and bail out on too short EHLO response
• source: remove names from source comments
• spnego_sspi: add typecast to fix build warning
• src/makefile: fix uncompressed hugehelp.c generation
• ssh-libssh: do not specify O_APPEND when not in append mode
• ssh: move code into vssh for SSH backends
• sspi: fix memory leaks
• tests: Replace outdated test case numbering documentation
• tftp: return error when packet is too small for options
• timediff: make it 64 bit (if possible) even with 32 bit time_t
• travis: reduce number of torture tests in ‘coverage’
• url: make use of new HTTP version if alt-svc has one
• urlapi: verify the IPv6 numerical address
• urldata: avoid ‘generic’, use dedicated pointers
• vauth: Use CURLE_AUTH_ERROR for auth function errors

Download

How to use curl

Basic GET

GET a single resource via its URI

The default operation is a GET:

curl http://api.example.com:8080/statuses/1234

GET multiple resources where IDs are in a range

Use square brackets with a dashed range:

curl http://api.example.com:8080/items/[1230-1234]

GET multiple resources where IDs aren’t in a range

Use curly braces with comma-delimited strings:

curl http://api.example.com:8080/products/{abc,def,ghi}/status

Using HTTP Headers

Accept only the application/json content-type

Use the header option: -H or –header

curl -H 'Accept: application/json' http://api.example.com:8080/items/1234

Add multiple headers

Use multiple -H options:

curl -H ‘Accept: application/json’ -H ‘Accept-Encoding: gzip’ http://api.example.com:8080/products/a1b2c3ef/status

Note: the output from this is likely to be unreadable because it’s gzipped!

More likely you’d use this with ETags:

curl -H ‘Accept: application/json’ -H ‘If-None-Match: “1cc044-172-3d9aee80″‘ http://api.example.com:8080/products/a1b2c3ef/status

Show the network and HTTP “conversation”

Use the verbose option: -v or –verbose

curl -v -H http://api.example.com

POST and PUT

POST data to a URI

To send data to the server, you use either POST or PUT, depending on what the API requires. To do a POST, you simply use the -d (–data)  with some content:

curl -d "name=Ted" http://api.example.com:8080/customers

Note that this uses application/x-www-form-urlencoded as the Content-Type, i.e.,as if it was submitted by an HTML Form. You can use multiple -d options, which will be combined, e.g., these two commands produce the same content:

curl -d “first=Ted” -d “last=Young” http://api.example.com:8080/customers
curl -d “first=Ted&last=Young” http://api.example.com:8080/customers

If you want to send JSON, you’ll need to specify the Content-Type explicitly using the -H (header) option:

curl -d '{"name": "Ted"}' -H 'Content-Type: application/json' http://api.example.com:8080/items

PUT data to a URI

If you need to use the PUT method, you’ll need to override the method with the -X (–request) option:

curl -X PUT -d ‘{“name”: “Ted”}’ -H ‘Content-Type: application/json’ http://api.example.com:8080/items/1234