Known problems/bugs in neon                                      -*- text -*-
---------------------------

* look at escaping logic again w.r.t. ?, # characters?

* 2818 requires that a on rejection of the SSL server cert, a "bad certificate"
 message should be sent - this is not being done currently (and can probably
 only be done with OpenSSL by actually doing cert verification in the verify
 callback)

* ne_lock_discover does not handle multiple (shared) locks on
  a single resource.

* ne_lock_refresh does not update the passed-in lock structure.

* SSL session caching issues; only cache for clean shutdowns, and
 only cache on shutdown, since the SSL_SESSION may change during
 an ne_session?

* what is passed as 'path' to req create hook: auth needs Request-URI;
  how does that interact with proxies?  also they will be passed NULL
  for a CONNECT request, or "*" possibly as well.

* It would be nice to fail with a friendly error message if a client
cert is requested by the srever but one is not provided.  Currently,
returning -1 from the provide_client_cert function would allow that
(as it forces the SSL handshake to fail), but that would prevent
opportunistic use of client certificates, of the "SSLVerifyClient
optional" variety.

* D.J. Heap has a proxy which returns a 401 in response to a CONNECT;
relax the ne_auth rules to allow this since it's unambiguous.

* Error handling from ne__pull_request_body/send_request_body is
buggy: socket errors are not distinguished from body provider errors;
the connection must be closed in ne_request after a body provider
error.

* Check whether the following always return UTF-8-encoded strings:
  - ne_ssl_clicert_name
  - ne_ssl_cert_identity