# Feature catalog — curl/curl

> Canonical page: https://codevetter.com/unpack/curl/feature-catalog

# Feature catalog — curl/curl

Scanned commit c362f034692e05ecb4d33edb740ba64c63a20add (2026-09-22). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

User-facing surface splits in two. The `curl` tool exposes ~298 documented command-line options plus higher-level conveniences: URL globbing, parallel transfers, retry policies, ETag compare/store, `--write-out` templating (including JSON), config files, user-defined `--variable` expansion, `--libcurl` source generation, and xattr metadata. libcurl exposes ~91 documented API functions and ~422 documented options, covering the easy, multi, share, URL, header, mime, and WebSocket APIs. Protocol coverage is the headline feature: HTTP/1.1, HTTP/2, HTTP/3, FTP(S), SFTP/SCP, SMTP/IMAP/POP3, LDAP(S), MQTT, RTSP, TFTP, DICT, Gopher, Telnet, WS(S), and local `file`. Authentication and proxying are each their own subsystem with many interchangeable mechanisms.
- The command-line grammar is a single alphabetically-sorted `aliases[]` table of `struct LongShort` (long name, ARG_* type bits such as ARG_BOOL/ARG_FILE/ARG_STRG/ARG_SECS plus ARG_NO/ARG_TLS/ARG_CLEAR modifiers, short letter, and a `C_*` id); `findlongopt()`/`findshortopt()` resolve into it. — [src/tool_getparam.c#L75-L112](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/tool_getparam.c#L75-L112) [src/tool_getparam.c#L838-L1090](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/tool_getparam.c#L838-L1090)
- Every command-line option has a matching curldown page — 298 files under docs/cmdline-opts/ — and the underscore-prefixed ones (`_OPTIONS.md`, `_GLOBBING.md`, `_VARIABLES.md`, `_EXITCODES.md`) are the manpage's prose sections. — [docs/cmdline-opts/_OPTIONS.md](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/docs/cmdline-opts/_OPTIONS.md) [docs/cmdline-opts/_GLOBBING.md](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/docs/cmdline-opts/_GLOBBING.md) [docs/cmdline-opts/abstract-unix-socket.md](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/docs/cmdline-opts/abstract-unix-socket.md)
- `--parallel` switches the tool from `serial_transfers()` to `parallel_transfers()`, which drives a real `CURLM` with `CURLMOPT_MAX_HOST_CONNECTIONS`, a notify callback, and `curl_multi_poll()`/`curl_multi_perform()`; concurrency is capped by `MAX_PARALLEL`/`MAX_PARALLEL_HOST` with `PARALLEL_DEFAULT` as the default. — [src/tool_operate.c#L1991-L2089](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/tool_operate.c#L1991-L2089) [src/tool_getparam.c#L2420-L2440](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/tool_getparam.c#L2420-L2440) [src/tool_cfgable.c#L323](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/tool_cfgable.c#L323)
- URL globbing (`http://host/[1-100]`, `{a,b}`) is implemented in src/tool_urlglob.c and feeds `glob_match_url()`, which also resolves `#1`..`#9` back-references when composing output filenames. — [src/tool_urlglob.c#L800-L815](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/tool_urlglob.c#L800-L815) [src/tool_operate.c#L1063-L1092](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/tool_operate.c#L1063-L1092)
- `--write-out` is table-driven: a `writeoutvar variables[]` array maps names like `http_code`, `time_total`, `num_retries`, `conn_id`, `filename_effective` to a CURLINFO id and a writer function, with `%{json}`, `%{header_json}`, `%header{}`, `%time{}` and `%output{}` handled as special forms. — [src/tool_writeout.c#L427-L450](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/tool_writeout.c#L427-L450) [src/tool_writeout.c#L760-L855](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/tool_writeout.c#L760-L855) [src/tool_writeout_json.c](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/tool_writeout_json.c)
- `--libcurl <file>` makes the tool emit an equivalent C program: `easysrc_init()`/`easysrc_perform()`/`dumpeasysrc()` are wired into `operate()` and the serial loop, and the `my_setopt*` macros in src/tool_setopt.c double as source emitters. — [src/tool_operate.c#L2494-L2545](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/tool_operate.c#L2494-L2545) [src/tool_easysrc.c](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/tool_easysrc.c) [src/tool_setopt.c](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/tool_setopt.c)
- `--variable` supports environment expansion with functions: src/var.c reads `getenv(name)` directly (rather than `curl_getenv()`) specifically so that a blank-but-set variable is distinguishable. — [src/var.c#L395-L410](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/var.c#L395-L410)
- IPFS/IPNS URLs are a tool-level feature that reads `IPFS_GATEWAY`, then falls back to `IPFS_PATH`, then `$HOME/.ipfs/gateway`, rewriting `ipfs://` into an HTTP gateway request. — [src/tool_ipfs.c#L40-L70](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/tool_ipfs.c#L40-L70) [docs/IPFS.md](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/docs/IPFS.md)
- Transfer resilience is a tool feature, not a library one: `retrycheck()` retries on timeouts/resolve failures, on HTTP 408/429/500/502/503/504/522/524, on FTP 4xx, on `--retry-connrefused`, and on `--retry-all-errors`, truncating the output file before each new attempt. — [src/tool_operate.c#L433-L530](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/tool_operate.c#L433-L530)
- HTTP/3 ships with two interchangeable QUIC backends — ngtcp2 (`lib/vquic/cf-ngtcp2.c`) and quiche (`lib/vquic/cf-quiche.c`) — each registering a `Curl_cft_http3` filter, plus an experimental HTTP/3 proxy path via `cf-ngtcp2-proxy.c` and CONNECT-UDP capsules. — [lib/vquic/cf-ngtcp2.c#L1089](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/vquic/cf-ngtcp2.c#L1089) [lib/vquic/cf-quiche.c#L1624](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/vquic/cf-quiche.c#L1624) [lib/vquic/cf-capsule.c#L243](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/vquic/cf-capsule.c#L243) [docs/EXPERIMENTAL.md#L37-L50](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/docs/EXPERIMENTAL.md#L37-L50)
- WebSocket support is a public API (`curl_ws_recv()`, `curl_ws_send()`, `curl_ws_meta()`) declared in include/curl/websockets.h and implemented in lib/ws.c with frame-level fragmentation handling. — [include/curl/websockets.h](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/include/curl/websockets.h) [lib/ws.c#L1592-L1700](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/ws.c#L1592-L1700) [lib/ws.c#L1850-L1930](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/ws.c#L1850-L1930) [docs/internals/WEBSOCKET.md](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/docs/internals/WEBSOCKET.md)
- Authentication mechanisms are pluggable per-mechanism files under lib/vauth/: cleartext, CRAM-MD5, DIGEST (native and SSPI), NTLM (native and SSPI), Kerberos 5 (GSSAPI and SSPI), SPNEGO (GSSAPI and SSPI), OAuth2, and GSASL. — [lib/vauth/vauth.h](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/vauth/vauth.h) [lib/vauth/digest.c](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/vauth/digest.c) [lib/vauth/krb5_gssapi.c](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/vauth/krb5_gssapi.c) [lib/vauth/oauth2.c](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/vauth/oauth2.c)
- Request signing is supported for two schemes: AWS SigV4 (`lib/http_aws_sigv4.c`, `--aws-sigv4`) and HTTP Message Signatures (`lib/http_httpsig.c`, wired through `httpsig_setopts()` with `CURLOPT_HTTPSIG_ALGORITHM`/`CURLOPT_HTTPSIG_KEY`). — [lib/http_aws_sigv4.c](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/http_aws_sigv4.c) [lib/http_httpsig.c](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/http_httpsig.c) [src/config2setopts.c#L583-L645](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/src/config2setopts.c#L583-L645)
- DNS-over-HTTPS is implemented as sub-transfers: `Curl_doh()` spins up to three probes (A, AAAA, HTTPS RR) as separate easy handles attached to the parent via `CURL_EZM_DOH_PROBE` metadata and a `sub_xfer_done` callback. — [lib/vdns/doh.c#L403-L490](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/vdns/doh.c#L403-L490) [lib/vdns/doh.c#L234-L395](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/vdns/doh.c#L234-L395)
- Proxy support spans SOCKS4/4a/5/5h (`lib/socks.c` plus GSSAPI/SSPI variants), HTTP proxies with CONNECT tunneling over HTTP/1 and HTTP/2 (`lib/cf-h1-proxy.c`, `lib/cf-h2-proxy.c`), and the HAProxy PROXY protocol header (`lib/cf-haproxy.c`). — [lib/socks.c#L1307](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/socks.c#L1307) [lib/cf-h2-proxy.c#L1471](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/cf-h2-proxy.c#L1471) [lib/cf-haproxy.c#L182](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/cf-haproxy.c#L182) [lib/http_proxy.c#L704](https://github.com/curl/curl/blob/c362f034692e05ecb4d33edb740ba64c63a20add/lib/http_proxy.c#L704)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)