Index: include/curl/curl.h
===================================================================
RCS file: /cvsroot/curl/curl/include/curl/curl.h,v
retrieving revision 1.262
diff -u -r1.262 curl.h
--- include/curl/curl.h	10 Sep 2004 21:46:58 -0000	1.262
+++ include/curl/curl.h	16 Sep 2004 11:16:16 -0000
@@ -303,6 +303,7 @@
 
 #define CURL_ERROR_SIZE 256
 
+/* parameter for the CURLOPT_FTP_SSL option */
 typedef enum {
   CURLFTPSSL_NONE,    /* do not attempt to use SSL */
   CURLFTPSSL_TRY,     /* try using SSL, proceed anyway otherwise */
@@ -311,6 +312,14 @@
   CURLFTPSSL_LAST     /* not an option, never use */
 } curl_ftpssl;
 
+/* parameter for the CURLOPT_FTPSSLAUTH option */
+typedef enum {
+  CURLFTPAUTH_DEFAULT, /* let libcurl decide */
+  CURLFTPAUTH_SSL,     /* use "AUTH SSL" */
+  CURLFTPAUTH_TLS,     /* use "AUTH TLS" */
+  CURLFTPAUTH_LAST /* not an option, never use */
+} curl_ftpauth;
+
 /* long may be 32 or 64 bits, but we should never depend on anything else
    but 32 */
 #define CURLOPTTYPE_LONG          0
@@ -813,6 +822,18 @@
      of commands with this */
   CINIT(SOURCE_POSTQUOTE, OBJECTPOINT, 128),
 
+  /* When FTP over SSL/TLS is selected (with CURLOPT_FTP_SSL), this option
+     can be used to change libcurl's default action which is to first try
+     "AUTH SSL" and then "AUTH TLS" in this order, and proceed when a OK
+     response has been received.
+
+     Available parameters are:
+     CURLFTPAUTH_DEFAULT - let libcurl decide
+     CURLFTPAUTH_SSL     - try "AUTH SSL" first, then TLS
+     CURLFTPAUTH_TLS     - try "AUTH TLS" first, then SSL
+  */
+  CINIT(FTPSSLAUTH, LONG, 129),
+
   CURLOPT_LASTENTRY /* the last unused */
 } CURLoption;
 
Index: lib/ftp.c
===================================================================
RCS file: /cvsroot/curl/curl/lib/ftp.c,v
retrieving revision 1.269
diff -u -r1.269 ftp.c
--- lib/ftp.c	13 Sep 2004 20:43:12 -0000	1.269
+++ lib/ftp.c	16 Sep 2004 11:16:17 -0000
@@ -540,8 +540,26 @@
 
   if(data->set.ftp_ssl && !conn->ssl[FIRSTSOCKET].use) {
     /* we don't have a SSL/TLS connection, try a FTPS connection now */
+    int start;
+    int trynext;
+    int count=0;
+
+    switch(data->set.ftpsslauth) {
+    case CURLFTPAUTH_DEFAULT:
+    case CURLFTPAUTH_SSL:
+      start = 0;
+      trynext = 1;
+      break;
+    case CURLFTPAUTH_TLS:
+      start = 1;
+      trynext = 0;
+    default:
+      failf(data, "unsupported parameter to CURLOPT_FTPSSLAUTH: %d\n",
+            data->set.ftpsslauth);
+      return CURLE_FAILED_INIT; /* we don't know what to do */
+    }
 
-    for (try = 0; ftpauth[try]; try++) {
+    for (try = start; ftpauth[count]; try=trynext, count++) {
 
       FTPSENDF(conn, "AUTH %s", ftpauth[try]);
 
Index: lib/url.c
===================================================================
RCS file: /cvsroot/curl/curl/lib/url.c,v
retrieving revision 1.407
diff -u -r1.407 url.c
--- lib/url.c	10 Sep 2004 20:58:51 -0000	1.407
+++ lib/url.c	16 Sep 2004 11:16:18 -0000
@@ -1338,6 +1338,13 @@
     data->set.ftp_ssl = (curl_ftpssl)va_arg(param, long);
     break;
 
+  case CURLOPT_FTPSSLAUTH:
+    /*
+     * Set a specific auth for FTP-SSL transfers.
+     */
+    data->set.ftpsslauth = (curl_ftpauth)va_arg(param, long);
+    break;
+
   case CURLOPT_IPRESOLVE:
     data->set.ip_version = va_arg(param, long);
     break;
Index: lib/urldata.h
===================================================================
RCS file: /cvsroot/curl/curl/lib/urldata.h,v
retrieving revision 1.237
diff -u -r1.237 urldata.h
--- lib/urldata.h	10 Sep 2004 20:58:51 -0000	1.237
+++ lib/urldata.h	16 Sep 2004 11:16:18 -0000
@@ -920,6 +920,7 @@
   bool ftp_use_epsv;     /* if EPSV is to be attempted or not */
   bool ftp_use_eprt;     /* if EPRT is to be attempted or not */
   curl_ftpssl ftp_ssl;   /* if AUTH TLS is to be attempted etc */
+  curl_ftpauth ftpsslauth; /* what AUTH XXX to be attempted */
   bool no_signal;        /* do not use any signal/alarm handler */
   bool global_dns_cache; /* subject for future removal */
   bool tcp_nodelay;      /* whether to enable TCP_NODELAY or not */