libcurl: update to 8.1.2

15 files changed, 622 insertions, 615 deletions

diff --git a/libs/libcurl/src/vtls/bearssl.c b/libs/libcurl/src/vtls/bearssl.c
index 4977f162d9..b273e493ea 100644
--- a/libs/libcurl/src/vtls/bearssl.c
+++ b/libs/libcurl/src/vtls/bearssl.c
@@ -849,7 +849,7 @@ static CURLcode bearssl_connect_step3(struct Curl_cfilter *cf,
   DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);

   DEBUGASSERT(backend);

 

-  if(cf->conn->bits.tls_enable_alpn) {

+  if(connssl->alpn) {

     const char *proto;

 

     proto = br_ssl_engine_get_selected_protocol(&backend->ctx.eng);

@@ -897,7 +897,7 @@ static ssize_t bearssl_send(struct Curl_cfilter *cf, struct Curl_easy *data,
 

   for(;;) {

     *err = bearssl_run_until(cf, data, BR_SSL_SENDAPP);

-    if (*err != CURLE_OK)

+    if(*err)

       return -1;

     app = br_ssl_engine_sendapp_buf(&backend->ctx.eng, &applen);

     if(!app) {

diff --git a/libs/libcurl/src/vtls/gskit.c b/libs/libcurl/src/vtls/gskit.c
index 84d692da55..79d1851720 100644
--- a/libs/libcurl/src/vtls/gskit.c
+++ b/libs/libcurl/src/vtls/gskit.c
@@ -511,7 +511,8 @@ static void close_async_handshake(struct ssl_connect_data *connssl)
   BACKEND->iocport = -1;

 }

 

-static int pipe_ssloverssl(struct Curl_cfilter *cf, int directions)

+static int pipe_ssloverssl(struct Curl_cfilter *cf, struct Curl_easy *data,

+                           int directions)

 {

   struct ssl_connect_data *connssl = cf->ctx;

   struct Curl_cfilter *cf_ssl_next = Curl_ssl_cf_get_ssl(cf->next);

@@ -594,7 +595,7 @@ static void close_one(struct Curl_cfilter *cf, struct Curl_easy *data)
     gskit_status(data, gsk_secure_soc_close(&BACKEND->handle),

               "gsk_secure_soc_close()", 0);

     /* Last chance to drain output. */

-    while(pipe_ssloverssl(cf, SOS_WRITE) > 0)

+    while(pipe_ssloverssl(cf, data, SOS_WRITE) > 0)

       ;

     BACKEND->handle = (gsk_handle) NULL;

     if(BACKEND->localfd >= 0) {

@@ -621,13 +622,13 @@ static ssize_t gskit_send(struct Curl_cfilter *cf, struct Curl_easy *data,
 

   DEBUGASSERT(BACKEND);

 

-  if(pipe_ssloverssl(cf, SOS_WRITE) >= 0) {

+  if(pipe_ssloverssl(cf, data, SOS_WRITE) >= 0) {

     cc = gskit_status(data,

                       gsk_secure_soc_write(BACKEND->handle,

                                            (char *) mem, (int) len, &written),

                       "gsk_secure_soc_write()", CURLE_SEND_ERROR);

     if(cc == CURLE_OK)

-      if(pipe_ssloverssl(cf, SOS_WRITE) < 0)

+      if(pipe_ssloverssl(cf, data, SOS_WRITE) < 0)

         cc = CURLE_SEND_ERROR;

   }

   if(cc != CURLE_OK) {

@@ -649,7 +650,7 @@ static ssize_t gskit_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
   (void)data;

   DEBUGASSERT(BACKEND);

 

-  if(pipe_ssloverssl(cf, SOS_READ) >= 0) {

+  if(pipe_ssloverssl(cf, data, SOS_READ) >= 0) {

     int buffsize = buffersize > (size_t) INT_MAX? INT_MAX: (int) buffersize;

     cc = gskit_status(data, gsk_secure_soc_read(BACKEND->handle,

                                                 buf, buffsize, &nread),

@@ -716,7 +717,7 @@ static CURLcode gskit_connect_step1(struct Curl_cfilter *cf,
   gsk_handle envir;

   CURLcode result;

   const char * const keyringfile = conn_config->CAfile;

-  const char * const keyringpwd = conn_config->key_passwd;

+  const char * const keyringpwd = ssl_config->key_passwd;

   const char * const keyringlabel = ssl_config->primary.clientcert;

   const long int ssl_version = conn_config->version;

   const bool verifypeer = conn_config->verifypeer;

@@ -932,7 +933,7 @@ static CURLcode gskit_connect_step1(struct Curl_cfilter *cf,
   }

 

   /* Error: rollback. */

-  close_one(connssl, data, conn, sockindex);

+  close_one(cf, data);

   return result;

 }

 

@@ -1111,7 +1112,7 @@ static CURLcode gskit_connect_common(struct Curl_cfilter *cf,
 

   /* Handle handshake pipelining. */

   if(!result)

-    if(pipe_ssloverssl(cf, SOS_READ | SOS_WRITE) < 0)

+    if(pipe_ssloverssl(cf, data, SOS_READ | SOS_WRITE) < 0)

       result = CURLE_SSL_CONNECT_ERROR;

 

   /* Step 2: check if handshake is over. */

@@ -1130,7 +1131,7 @@ static CURLcode gskit_connect_common(struct Curl_cfilter *cf,
 

   /* Handle handshake pipelining. */

   if(!result)

-    if(pipe_ssloverssl(cf, SOS_READ | SOS_WRITE) < 0)

+    if(pipe_ssloverssl(cf, data, SOS_READ | SOS_WRITE) < 0)

       result = CURLE_SSL_CONNECT_ERROR;

 

   /* Step 3: gather certificate info, verify host. */

@@ -1138,7 +1139,7 @@ static CURLcode gskit_connect_common(struct Curl_cfilter *cf,
     result = gskit_connect_step3(cf, data);

 

   if(result)

-    close_one(connssl, data, conn, sockindex);

+    close_one(cf, data);

   else if(connssl->connecting_state == ssl_connect_done) {

     connssl->state = ssl_connection_complete;

     connssl->connecting_state = ssl_connect_1;

@@ -1271,7 +1272,7 @@ static int gskit_check_cxn(struct Curl_cfilter *cf,
   err = 0;

   errlen = sizeof(err);

 

-  if(getsockopt(cxn->sock[FIRSTSOCKET], SOL_SOCKET, SO_ERROR,

+  if(getsockopt(Curl_conn_cf_get_socket(cf, data), SOL_SOCKET, SO_ERROR,

                  (unsigned char *) &err, &errlen) ||

      errlen != sizeof(err) || err)

     return 0; /* connection has been closed */

diff --git a/libs/libcurl/src/vtls/gtls.c b/libs/libcurl/src/vtls/gtls.c
index 72e2d5324d..c280cedc78 100644
--- a/libs/libcurl/src/vtls/gtls.c
+++ b/libs/libcurl/src/vtls/gtls.c
@@ -1252,7 +1252,7 @@ static CURLcode gtls_verifyserver(struct Curl_cfilter *cf,
   if(result)

     goto out;

 

-  if(cf->conn->bits.tls_enable_alpn) {

+  if(connssl->alpn) {

     gnutls_datum_t proto;

     int rc;

 

diff --git a/libs/libcurl/src/vtls/hostcheck.c b/libs/libcurl/src/vtls/hostcheck.c
index 4b4a364377..c2d1fb0ba1 100644
--- a/libs/libcurl/src/vtls/hostcheck.c
+++ b/libs/libcurl/src/vtls/hostcheck.c
@@ -71,7 +71,12 @@ static bool pmatch(const char *hostname, size_t hostlen,
  * apparent distinction between a name and an IP. We need to detect the use of

  * an IP address and not wildcard match on such names.

  *

+ * Only match on "*" being used for the leftmost label, not "a*", "a*b" nor

+ * "*b".

+ *

  * Return TRUE on a match. FALSE if not.

+ *

+ * @unittest: 1397

  */

 

 static bool hostmatch(const char *hostname,

@@ -79,53 +84,42 @@ static bool hostmatch(const char *hostname,
                       const char *pattern,

                       size_t patternlen)

 {

-  const char *pattern_label_end, *wildcard, *hostname_label_end;

-  size_t prefixlen, suffixlen;

+  const char *pattern_label_end;

 

-  /* normalize pattern and hostname by stripping off trailing dots */

+  DEBUGASSERT(pattern);

   DEBUGASSERT(patternlen);

+  DEBUGASSERT(hostname);

+  DEBUGASSERT(hostlen);

+

+  /* normalize pattern and hostname by stripping off trailing dots */

   if(hostname[hostlen-1]=='.')

     hostlen--;

   if(pattern[patternlen-1]=='.')

     patternlen--;

 

-  wildcard = memchr(pattern, '*', patternlen);

-  if(!wildcard)

+  if(strncmp(pattern, "*.", 2))

     return pmatch(hostname, hostlen, pattern, patternlen);

 

   /* detect IP address as hostname and fail the match if so */

-  if(Curl_host_is_ipnum(hostname))

+  else if(Curl_host_is_ipnum(hostname))

     return FALSE;

 

   /* We require at least 2 dots in the pattern to avoid too wide wildcard

      match. */

   pattern_label_end = memchr(pattern, '.', patternlen);

   if(!pattern_label_end ||

-     (memrchr(pattern, '.', patternlen) == pattern_label_end) ||

-     strncasecompare(pattern, "xn--", 4))

+     (memrchr(pattern, '.', patternlen) == pattern_label_end))

     return pmatch(hostname, hostlen, pattern, patternlen);

-

-  hostname_label_end = memchr(hostname, '.', hostlen);

-  if(!hostname_label_end)

-    return FALSE;

   else {

-    size_t skiphost = hostname_label_end - hostname;

-    size_t skiplen = pattern_label_end - pattern;

-    if(!pmatch(hostname_label_end, hostlen - skiphost,

-               pattern_label_end, patternlen - skiplen))

-      return FALSE;

+    const char *hostname_label_end = memchr(hostname, '.', hostlen);

+    if(hostname_label_end) {

+      size_t skiphost = hostname_label_end - hostname;

+      size_t skiplen = pattern_label_end - pattern;

+      return pmatch(hostname_label_end, hostlen - skiphost,

+                    pattern_label_end, patternlen - skiplen);

+    }

   }

-  /* The wildcard must match at least one character, so the left-most

-     label of the hostname is at least as large as the left-most label

-     of the pattern. */

-  if(hostname_label_end - hostname < pattern_label_end - pattern)

-    return FALSE;

-

-  prefixlen = wildcard - pattern;

-  suffixlen = pattern_label_end - (wildcard + 1);

-  return strncasecompare(pattern, hostname, prefixlen) &&

-    strncasecompare(wildcard + 1, hostname_label_end - suffixlen,

-                    suffixlen) ? TRUE : FALSE;

+  return FALSE;

 }

 

 /*

diff --git a/libs/libcurl/src/vtls/mbedtls.c b/libs/libcurl/src/vtls/mbedtls.c
index d68ed174a2..7d084af412 100644
--- a/libs/libcurl/src/vtls/mbedtls.c
+++ b/libs/libcurl/src/vtls/mbedtls.c
@@ -831,7 +831,7 @@ mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
     result = Curl_pin_peer_pubkey(data,

                                   pinnedpubkey,

                                   &pubkey[PUB_DER_MAX_BYTES - size], size);

-    pinnedpubkey_error:

+pinnedpubkey_error:

     mbedtls_x509_crt_free(p);

     free(p);

     free(pubkey);

diff --git a/libs/libcurl/src/vtls/nss.c b/libs/libcurl/src/vtls/nss.c
index 2bbf96ab96..505853c61b 100644
--- a/libs/libcurl/src/vtls/nss.c
+++ b/libs/libcurl/src/vtls/nss.c
@@ -852,14 +852,13 @@ static void HandshakeCallback(PRFileDesc *sock, void *arg)
   struct Curl_cfilter *cf = (struct Curl_cfilter *)arg;

   struct ssl_connect_data *connssl = cf->ctx;

   struct Curl_easy *data = connssl->backend->data;

-  struct connectdata *conn = cf->conn;

   unsigned int buflenmax = 50;

   unsigned char buf[50];

   unsigned int buflen;

   SSLNextProtoState state;

 

   DEBUGASSERT(data);

-  if(!conn->bits.tls_enable_alpn) {

+  if(!connssl->alpn) {

     return;

   }

 

@@ -2096,7 +2095,7 @@ static CURLcode nss_setup_connect(struct Curl_cfilter *cf,
 

 #ifdef SSL_ENABLE_ALPN

   if(SSL_OptionSet(backend->handle, SSL_ENABLE_ALPN,

-                   cf->conn->bits.tls_enable_alpn ? PR_TRUE : PR_FALSE)

+                   connssl->alpn ? PR_TRUE : PR_FALSE)

       != SECSuccess)

     goto error;

 #endif

diff --git a/libs/libcurl/src/vtls/openssl.c b/libs/libcurl/src/vtls/openssl.c
index c9cc52a184..470daedb2c 100644
--- a/libs/libcurl/src/vtls/openssl.c
+++ b/libs/libcurl/src/vtls/openssl.c
@@ -207,8 +207,10 @@
 #if ((OPENSSL_VERSION_NUMBER >= 0x10101000L) && \

      !defined(LIBRESSL_VERSION_NUMBER) &&       \

      !defined(OPENSSL_IS_BORINGSSL))

-#define HAVE_SSL_CTX_SET_CIPHERSUITES

-#define HAVE_SSL_CTX_SET_POST_HANDSHAKE_AUTH

+  #define HAVE_SSL_CTX_SET_CIPHERSUITES

+  #if !defined(OPENSSL_IS_AWSLC)

+    #define HAVE_SSL_CTX_SET_POST_HANDSHAKE_AUTH

+  #endif

 #endif

 

 /*

@@ -227,6 +229,8 @@
 #define OSSL_PACKAGE "LibreSSL"

 #elif defined(OPENSSL_IS_BORINGSSL)

 #define OSSL_PACKAGE "BoringSSL"

+#elif defined(OPENSSL_IS_AWSLC)

+#define OSSL_PACKAGE "AWS-LC"

 #else

 #define OSSL_PACKAGE "OpenSSL"

 #endif

@@ -257,7 +261,8 @@
 #if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && \

     !(defined(LIBRESSL_VERSION_NUMBER) && \

       LIBRESSL_VERSION_NUMBER < 0x2070100fL) && \

-    !defined(OPENSSL_IS_BORINGSSL)

+    !defined(OPENSSL_IS_BORINGSSL) && \

+    !defined(OPENSSL_IS_AWSLC)

 #define HAVE_OPENSSL_VERSION

 #endif

 

@@ -360,8 +365,8 @@ static int asn1_object_dump(ASN1_OBJECT *a, char *buf, size_t len)
 }

 

 static void X509V3_ext(struct Curl_easy *data,

-                      int certnum,

-                      CONST_EXTS STACK_OF(X509_EXTENSION) *exts)

+                       int certnum,

+                       CONST_EXTS STACK_OF(X509_EXTENSION) *exts)

 {

   int i;

 

@@ -393,7 +398,7 @@ static void X509V3_ext(struct Curl_easy *data,
   }

 }

 

-#ifdef OPENSSL_IS_BORINGSSL

+#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)

 typedef size_t numcert_t;

 #else

 typedef int numcert_t;

@@ -617,7 +622,7 @@ CURLcode Curl_ossl_certchain(struct Curl_easy *data, SSL *ssl)
           FREE_PKEY_PARAM_BIGNUM(q);

           FREE_PKEY_PARAM_BIGNUM(g);

           FREE_PKEY_PARAM_BIGNUM(pub_key);

-       }

+        }

         break;

       }

       }

@@ -840,9 +845,9 @@ ossl_log_tls12_secret(const SSL *ssl, bool *keylog_done)
   if(!session || *keylog_done)

     return;

 

-#if OPENSSL_VERSION_NUMBER >= 0x10100000L && \

-    !(defined(LIBRESSL_VERSION_NUMBER) && \

-      LIBRESSL_VERSION_NUMBER < 0x20700000L)

+#if OPENSSL_VERSION_NUMBER >= 0x10100000L &&    \

+  !(defined(LIBRESSL_VERSION_NUMBER) &&         \

+    LIBRESSL_VERSION_NUMBER < 0x20700000L)

   /* ssl->s3 is not checked in openssl 1.1.0-pre6, but let's assume that

    * we have a valid SSL context if we have a non-NULL session. */

   SSL_get_client_random(ssl, client_random, SSL3_RANDOM_SIZE);

@@ -926,7 +931,7 @@ static char *ossl_strerror(unsigned long error, char *buf, size_t size)
     *buf = '\0';

   }

 

-#ifdef OPENSSL_IS_BORINGSSL

+#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)

   ERR_error_string_n((uint32_t)error, buf, size);

 #else

   ERR_error_string_n(error, buf, size);

@@ -1148,7 +1153,7 @@ SSL_CTX_use_certificate_blob(SSL_CTX *ctx, const struct curl_blob *blob,
   }

 

   ret = SSL_CTX_use_certificate(ctx, x);

- end:

+end:

   X509_free(x);

   BIO_free(in);

   return ret;

@@ -1156,7 +1161,7 @@ SSL_CTX_use_certificate_blob(SSL_CTX *ctx, const struct curl_blob *blob,
 

 static int

 SSL_CTX_use_PrivateKey_blob(SSL_CTX *ctx, const struct curl_blob *blob,

-                           int type, const char *key_passwd)

+                            int type, const char *key_passwd)

 {

   int ret = 0;

   EVP_PKEY *pkey = NULL;

@@ -1179,7 +1184,7 @@ SSL_CTX_use_PrivateKey_blob(SSL_CTX *ctx, const struct curl_blob *blob,
   }

   ret = SSL_CTX_use_PrivateKey(ctx, pkey);

   EVP_PKEY_free(pkey);

-  end:

+end:

   BIO_free(in);

   return ret;

 }

@@ -1190,8 +1195,8 @@ SSL_CTX_use_certificate_chain_blob(SSL_CTX *ctx, const struct curl_blob *blob,
 {

 /* SSL_CTX_add1_chain_cert introduced in OpenSSL 1.0.2 */

 #if (OPENSSL_VERSION_NUMBER >= 0x1000200fL) && /* OpenSSL 1.0.2 or later */ \

-    !(defined(LIBRESSL_VERSION_NUMBER) && \

-      (LIBRESSL_VERSION_NUMBER < 0x2090100fL)) /* LibreSSL 2.9.1 or later */

+  !(defined(LIBRESSL_VERSION_NUMBER) &&                                     \

+    (LIBRESSL_VERSION_NUMBER < 0x2090100fL)) /* LibreSSL 2.9.1 or later */

   int ret = 0;

   X509 *x = NULL;

   void *passwd_callback_userdata = (void *)key_passwd;

@@ -1242,7 +1247,7 @@ SSL_CTX_use_certificate_chain_blob(SSL_CTX *ctx, const struct curl_blob *blob,
       ret = 0;

   }

 

- end:

+end:

   X509_free(x);

   BIO_free(in);

   return ret;

@@ -1310,7 +1315,7 @@ int cert_stuff(struct Curl_easy *data,
       cert_use_result = cert_blob ?

         SSL_CTX_use_certificate_blob(ctx, cert_blob,

                                      file_type, key_passwd) :

-        SSL_CTX_use_certificate_file(ctx, cert_file, file_type);

+      SSL_CTX_use_certificate_file(ctx, cert_file, file_type);

       if(cert_use_result != 1) {

         failf(data,

               "could not load ASN1 client certificate from %s, " OSSL_PACKAGE

@@ -1324,67 +1329,67 @@ int cert_stuff(struct Curl_easy *data,
       break;

     case SSL_FILETYPE_ENGINE:

 #if defined(USE_OPENSSL_ENGINE) && defined(ENGINE_CTRL_GET_CMD_FROM_NAME)

-      {

-        /* Implicitly use pkcs11 engine if none was provided and the

-         * cert_file is a PKCS#11 URI */

-        if(!data->state.engine) {

-          if(is_pkcs11_uri(cert_file)) {

-            if(ossl_set_engine(data, "pkcs11") != CURLE_OK) {

-              return 0;

-            }

+    {

+      /* Implicitly use pkcs11 engine if none was provided and the

+       * cert_file is a PKCS#11 URI */

+      if(!data->state.engine) {

+        if(is_pkcs11_uri(cert_file)) {

+          if(ossl_set_engine(data, "pkcs11") != CURLE_OK) {

+            return 0;

           }

         }

+      }

 

-        if(data->state.engine) {

-          const char *cmd_name = "LOAD_CERT_CTRL";

-          struct {

-            const char *cert_id;

-            X509 *cert;

-          } params;

-

-          params.cert_id = cert_file;

-          params.cert = NULL;

+      if(data->state.engine) {

+        const char *cmd_name = "LOAD_CERT_CTRL";

+        struct {

+          const char *cert_id;

+          X509 *cert;

+        } params;

 

-          /* Does the engine supports LOAD_CERT_CTRL ? */

-          if(!ENGINE_ctrl(data->state.engine, ENGINE_CTRL_GET_CMD_FROM_NAME,

-                          0, (void *)cmd_name, NULL)) {

-            failf(data, "ssl engine does not support loading certificates");

-            return 0;

-          }

+        params.cert_id = cert_file;

+        params.cert = NULL;

 

-          /* Load the certificate from the engine */

-          if(!ENGINE_ctrl_cmd(data->state.engine, cmd_name,

-                              0, &params, NULL, 1)) {

-            failf(data, "ssl engine cannot load client cert with id"

-                  " '%s' [%s]", cert_file,

-                  ossl_strerror(ERR_get_error(), error_buffer,

-                                sizeof(error_buffer)));

-            return 0;

-          }

+        /* Does the engine supports LOAD_CERT_CTRL ? */

+        if(!ENGINE_ctrl(data->state.engine, ENGINE_CTRL_GET_CMD_FROM_NAME,

+                        0, (void *)cmd_name, NULL)) {

+          failf(data, "ssl engine does not support loading certificates");

+          return 0;

+        }

 

-          if(!params.cert) {

-            failf(data, "ssl engine didn't initialized the certificate "

-                  "properly.");

-            return 0;

-          }

+        /* Load the certificate from the engine */

+        if(!ENGINE_ctrl_cmd(data->state.engine, cmd_name,

+                            0, &params, NULL, 1)) {

+          failf(data, "ssl engine cannot load client cert with id"

+                " '%s' [%s]", cert_file,

+                ossl_strerror(ERR_get_error(), error_buffer,

+                              sizeof(error_buffer)));

+          return 0;

+        }

 

-          if(SSL_CTX_use_certificate(ctx, params.cert) != 1) {

-            failf(data, "unable to set client certificate [%s]",

-                  ossl_strerror(ERR_get_error(), error_buffer,

-                                sizeof(error_buffer)));

-            return 0;

-          }

-          X509_free(params.cert); /* we don't need the handle any more... */

+        if(!params.cert) {

+          failf(data, "ssl engine didn't initialized the certificate "

+                "properly.");

+          return 0;

         }

-        else {

-          failf(data, "crypto engine not set, can't load certificate");

+

+        if(SSL_CTX_use_certificate(ctx, params.cert) != 1) {

+          failf(data, "unable to set client certificate [%s]",

+                ossl_strerror(ERR_get_error(), error_buffer,

+                              sizeof(error_buffer)));

           return 0;

         }

+        X509_free(params.cert); /* we don't need the handle any more... */

       }

-      break;

+      else {

+        failf(data, "crypto engine not set, can't load certificate");

+        return 0;

+      }

+    }

+    break;

 #else

-      failf(data, "file type ENG for certificate not implemented");

-      return 0;

+    failf(data, "file type ENG for certificate not implemented");

+    return 0;

 #endif

 

     case SSL_FILETYPE_PKCS12:

@@ -1491,7 +1496,7 @@ int cert_stuff(struct Curl_easy *data,
       }

 

       cert_done = 1;

-  fail:

+fail:

       EVP_PKEY_free(pri);

       X509_free(x509);

       sk_X509_pop_free(ca, X509_free);

@@ -1519,7 +1524,7 @@ int cert_stuff(struct Curl_easy *data,
     case SSL_FILETYPE_ASN1:

       cert_use_result = key_blob ?

         SSL_CTX_use_PrivateKey_blob(ctx, key_blob, file_type, key_passwd) :

-        SSL_CTX_use_PrivateKey_file(ctx, key_file, file_type);

+      SSL_CTX_use_PrivateKey_file(ctx, key_file, file_type);

       if(cert_use_result != 1) {

         failf(data, "unable to set private key file: '%s' type %s",

               key_file?key_file:"(memory blob)", key_type?key_type:"PEM");

@@ -1528,57 +1533,57 @@ int cert_stuff(struct Curl_easy *data,
       break;

     case SSL_FILETYPE_ENGINE:

 #ifdef USE_OPENSSL_ENGINE

-      {                         /* XXXX still needs some work */

-        EVP_PKEY *priv_key = NULL;

-

-        /* Implicitly use pkcs11 engine if none was provided and the

-         * key_file is a PKCS#11 URI */

-        if(!data->state.engine) {

-          if(is_pkcs11_uri(key_file)) {

-            if(ossl_set_engine(data, "pkcs11") != CURLE_OK) {

-              return 0;

-            }

-          }

-        }

+    {

+      EVP_PKEY *priv_key = NULL;

 

-        if(data->state.engine) {

-          UI_METHOD *ui_method =

-            UI_create_method((char *)"curl user interface");

-          if(!ui_method) {

-            failf(data, "unable do create " OSSL_PACKAGE

-                  " user-interface method");

-            return 0;

-          }

-          UI_method_set_opener(ui_method, UI_method_get_opener(UI_OpenSSL()));

-          UI_method_set_closer(ui_method, UI_method_get_closer(UI_OpenSSL()));

-          UI_method_set_reader(ui_method, ssl_ui_reader);

-          UI_method_set_writer(ui_method, ssl_ui_writer);

-          /* the typecast below was added to please mingw32 */

-          priv_key = (EVP_PKEY *)

-            ENGINE_load_private_key(data->state.engine, key_file,

-                                    ui_method,

-                                    key_passwd);

-          UI_destroy_method(ui_method);

-          if(!priv_key) {

-            failf(data, "failed to load private key from crypto engine");

-            return 0;

-          }

-          if(SSL_CTX_use_PrivateKey(ctx, priv_key) != 1) {

-            failf(data, "unable to set private key");

-            EVP_PKEY_free(priv_key);

+      /* Implicitly use pkcs11 engine if none was provided and the

+       * key_file is a PKCS#11 URI */

+      if(!data->state.engine) {

+        if(is_pkcs11_uri(key_file)) {

+          if(ossl_set_engine(data, "pkcs11") != CURLE_OK) {

             return 0;

           }

-          EVP_PKEY_free(priv_key);  /* we don't need the handle any more... */

         }

-        else {

-          failf(data, "crypto engine not set, can't load private key");

+      }

+

+      if(data->state.engine) {

+        UI_METHOD *ui_method =

+          UI_create_method((char *)"curl user interface");

+        if(!ui_method) {

+          failf(data, "unable do create " OSSL_PACKAGE

+                " user-interface method");

+          return 0;

+        }

+        UI_method_set_opener(ui_method, UI_method_get_opener(UI_OpenSSL()));

+        UI_method_set_closer(ui_method, UI_method_get_closer(UI_OpenSSL()));

+        UI_method_set_reader(ui_method, ssl_ui_reader);

+        UI_method_set_writer(ui_method, ssl_ui_writer);

+        /* the typecast below was added to please mingw32 */

+        priv_key = (EVP_PKEY *)

+          ENGINE_load_private_key(data->state.engine, key_file,

+                                  ui_method,

+                                  key_passwd);

+        UI_destroy_method(ui_method);

+        if(!priv_key) {

+          failf(data, "failed to load private key from crypto engine");

+          return 0;

+        }

+        if(SSL_CTX_use_PrivateKey(ctx, priv_key) != 1) {

+          failf(data, "unable to set private key");

+          EVP_PKEY_free(priv_key);

           return 0;

         }

+        EVP_PKEY_free(priv_key);  /* we don't need the handle any more... */

       }

-      break;

+      else {

+        failf(data, "crypto engine not set, can't load private key");

+        return 0;

+      }

+    }

+    break;

 #else

-      failf(data, "file type ENG for private key not supported");

-      return 0;

+    failf(data, "file type ENG for private key not supported");

+    return 0;

 #endif

     case SSL_FILETYPE_PKCS12:

       if(!cert_done) {

@@ -1607,8 +1612,8 @@ int cert_stuff(struct Curl_easy *data,
       EVP_PKEY_free(pktmp);

     }

 

-#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_IS_BORINGSSL) && \

-    !defined(OPENSSL_NO_DEPRECATED_3_0)

+#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_IS_BORINGSSL) &&       \

+  !defined(OPENSSL_NO_DEPRECATED_3_0)

     {

       /* If RSA is used, don't check the private key if its flags indicate

        * it doesn't support it. */

@@ -1746,8 +1751,8 @@ static int ossl_init(void)
 /* Global cleanup */

 static void ossl_cleanup(void)

 {

-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && \

-    !defined(LIBRESSL_VERSION_NUMBER)

+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) &&  \

+  !defined(LIBRESSL_VERSION_NUMBER)

   /* OpenSSL 1.1 deprecates all these cleanup functions and

      turns them into no-ops in OpenSSL 1.0 compatibility mode */

 #else

@@ -1930,7 +1935,7 @@ static int ossl_shutdown(struct Curl_cfilter *cf,
      we do not send one. Let's hope other servers do the same... */

 

   if(data->set.ftp_ccc == CURLFTPSSL_CCC_ACTIVE)

-      (void)SSL_shutdown(backend->handle);

+    (void)SSL_shutdown(backend->handle);

 #endif

 

   if(backend->handle) {

@@ -2031,7 +2036,7 @@ static void ossl_close_all(struct Curl_easy *data)
 #else

   (void)data;

 #endif

-#if !defined(HAVE_ERR_REMOVE_THREAD_STATE_DEPRECATED) && \

+#if !defined(HAVE_ERR_REMOVE_THREAD_STATE_DEPRECATED) &&        \

   defined(HAVE_ERR_REMOVE_THREAD_STATE)

   /* OpenSSL 1.0.1 and 1.0.2 build an error queue that is stored per-thread

      so we need to clean it here in case the thread will be killed. All OpenSSL

@@ -2059,7 +2064,7 @@ static bool subj_alt_hostcheck(struct Curl_easy *data,
 #endif

   if(Curl_cert_hostcheck(match_pattern, matchlen, hostname, hostlen)) {

     infof(data, " subjectAltName: host \"%s\" matched cert's \"%s\"",

-                  dispname, match_pattern);

+          dispname, match_pattern);

     return TRUE;

   }

   return FALSE;

@@ -2147,7 +2152,7 @@ ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
   altnames = X509_get_ext_d2i(server_cert, NID_subject_alt_name, NULL, NULL);

 

   if(altnames) {

-#ifdef OPENSSL_IS_BORINGSSL

+#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)

     size_t numalts;

     size_t i;

 #else

@@ -2303,7 +2308,7 @@ ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
 }

 

 #if (OPENSSL_VERSION_NUMBER >= 0x0090808fL) && !defined(OPENSSL_NO_TLSEXT) && \

-    !defined(OPENSSL_NO_OCSP)

+  !defined(OPENSSL_NO_OCSP)

 static CURLcode verifystatus(struct Curl_cfilter *cf,

                              struct Curl_easy *data)

 {

@@ -2477,81 +2482,81 @@ static const char *ssl_msg_type(int ssl_ver, int msg)
 #ifdef SSL2_VERSION_MAJOR

   if(ssl_ver == SSL2_VERSION_MAJOR) {

     switch(msg) {

-      case SSL2_MT_ERROR:

-        return "Error";

-      case SSL2_MT_CLIENT_HELLO:

-        return "Client hello";

-      case SSL2_MT_CLIENT_MASTER_KEY:

-        return "Client key";

-      case SSL2_MT_CLIENT_FINISHED:

-        return "Client finished";

-      case SSL2_MT_SERVER_HELLO:

-        return "Server hello";

-      case SSL2_MT_SERVER_VERIFY:

-        return "Server verify";

-      case SSL2_MT_SERVER_FINISHED:

-        return "Server finished";

-      case SSL2_MT_REQUEST_CERTIFICATE:

-        return "Request CERT";

-      case SSL2_MT_CLIENT_CERTIFICATE:

-        return "Client CERT";

+    case SSL2_MT_ERROR:

+      return "Error";

+    case SSL2_MT_CLIENT_HELLO:

+      return "Client hello";

+    case SSL2_MT_CLIENT_MASTER_KEY:

+      return "Client key";

+    case SSL2_MT_CLIENT_FINISHED:

+      return "Client finished";

+    case SSL2_MT_SERVER_HELLO:

+      return "Server hello";

+    case SSL2_MT_SERVER_VERIFY:

+      return "Server verify";

+    case SSL2_MT_SERVER_FINISHED:

+      return "Server finished";

+    case SSL2_MT_REQUEST_CERTIFICATE:

+      return "Request CERT";

+    case SSL2_MT_CLIENT_CERTIFICATE:

+      return "Client CERT";

     }

   }

   else

 #endif

   if(ssl_ver == SSL3_VERSION_MAJOR) {

     switch(msg) {

-      case SSL3_MT_HELLO_REQUEST:

-        return "Hello request";

-      case SSL3_MT_CLIENT_HELLO:

-        return "Client hello";

-      case SSL3_MT_SERVER_HELLO:

-        return "Server hello";

+    case SSL3_MT_HELLO_REQUEST:

+      return "Hello request";

+    case SSL3_MT_CLIENT_HELLO:

+      return "Client hello";

+    case SSL3_MT_SERVER_HELLO:

+      return "Server hello";

 #ifdef SSL3_MT_NEWSESSION_TICKET

-      case SSL3_MT_NEWSESSION_TICKET:

-        return "Newsession Ticket";

-#endif

-      case SSL3_MT_CERTIFICATE:

-        return "Certificate";

-      case SSL3_MT_SERVER_KEY_EXCHANGE:

-        return "Server key exchange";

-      case SSL3_MT_CLIENT_KEY_EXCHANGE:

-        return "Client key exchange";

-      case SSL3_MT_CERTIFICATE_REQUEST:

-        return "Request CERT";

-      case SSL3_MT_SERVER_DONE:

-        return "Server finished";

-      case SSL3_MT_CERTIFICATE_VERIFY:

-        return "CERT verify";

-      case SSL3_MT_FINISHED:

-        return "Finished";

+    case SSL3_MT_NEWSESSION_TICKET:

+      return "Newsession Ticket";

+#endif

+    case SSL3_MT_CERTIFICATE:

+      return "Certificate";

+    case SSL3_MT_SERVER_KEY_EXCHANGE:

+      return "Server key exchange";

+    case SSL3_MT_CLIENT_KEY_EXCHANGE:

+      return "Client key exchange";

+    case SSL3_MT_CERTIFICATE_REQUEST:

+      return "Request CERT";

+    case SSL3_MT_SERVER_DONE:

+      return "Server finished";

+    case SSL3_MT_CERTIFICATE_VERIFY:

+      return "CERT verify";

+    case SSL3_MT_FINISHED:

+      return "Finished";

 #ifdef SSL3_MT_CERTIFICATE_STATUS

-      case SSL3_MT_CERTIFICATE_STATUS:

-        return "Certificate Status";

+    case SSL3_MT_CERTIFICATE_STATUS:

+      return "Certificate Status";

 #endif

 #ifdef SSL3_MT_ENCRYPTED_EXTENSIONS

-      case SSL3_MT_ENCRYPTED_EXTENSIONS:

-        return "Encrypted Extensions";

+    case SSL3_MT_ENCRYPTED_EXTENSIONS:

+      return "Encrypted Extensions";

 #endif

 #ifdef SSL3_MT_SUPPLEMENTAL_DATA

-      case SSL3_MT_SUPPLEMENTAL_DATA:

-        return "Supplemental data";

+    case SSL3_MT_SUPPLEMENTAL_DATA:

+      return "Supplemental data";

 #endif

 #ifdef SSL3_MT_END_OF_EARLY_DATA

-      case SSL3_MT_END_OF_EARLY_DATA:

-        return "End of early data";

+    case SSL3_MT_END_OF_EARLY_DATA:

+      return "End of early data";

 #endif

 #ifdef SSL3_MT_KEY_UPDATE

-      case SSL3_MT_KEY_UPDATE:

-        return "Key update";

+    case SSL3_MT_KEY_UPDATE:

+      return "Key update";

 #endif

 #ifdef SSL3_MT_NEXT_PROTO

-      case SSL3_MT_NEXT_PROTO:

-        return "Next protocol";

+    case SSL3_MT_NEXT_PROTO:

+      return "Next protocol";

 #endif

 #ifdef SSL3_MT_MESSAGE_HASH

-      case SSL3_MT_MESSAGE_HASH:

-        return "Message hash";

+    case SSL3_MT_MESSAGE_HASH:

+      return "Message hash";

 #endif

     }

   }

@@ -2596,7 +2601,7 @@ static void ossl_trace(int direction, int ssl_ver, int content_type,
   if(!data || !data->set.fdebug || (direction && direction != 1))

     return;

 

- switch(ssl_ver) {

+  switch(ssl_ver) {

 #ifdef SSL2_VERSION /* removed in recent versions */

   case SSL2_VERSION:

     verstr = "SSLv2";

@@ -2701,8 +2706,8 @@ static void ossl_trace(int direction, int ssl_ver, int content_type,
 

 /* Check for OpenSSL 1.0.2 which has ALPN support. */

 #undef HAS_ALPN

-#if OPENSSL_VERSION_NUMBER >= 0x10002000L \

-    && !defined(OPENSSL_NO_TLSEXT)

+#if OPENSSL_VERSION_NUMBER >= 0x10002000L       \

+  && !defined(OPENSSL_NO_TLSEXT)

 #  define HAS_ALPN 1

 #endif

 

@@ -2716,7 +2721,9 @@ set_ssl_version_min_max(struct Curl_cfilter *cf, SSL_CTX *ctx)
   long curl_ssl_version_max;

 

   /* convert curl min SSL version option to OpenSSL constant */

-#if defined(OPENSSL_IS_BORINGSSL) || defined(LIBRESSL_VERSION_NUMBER)

+#if (defined(OPENSSL_IS_BORINGSSL)  || \

+     defined(OPENSSL_IS_AWSLC)      || \

+     defined(LIBRESSL_VERSION_NUMBER))

   uint16_t ossl_ssl_version_min = 0;

   uint16_t ossl_ssl_version_max = 0;

 #else

@@ -2724,22 +2731,22 @@ set_ssl_version_min_max(struct Curl_cfilter *cf, SSL_CTX *ctx)
   long ossl_ssl_version_max = 0;

 #endif

   switch(curl_ssl_version_min) {

-    case CURL_SSLVERSION_TLSv1: /* TLS 1.x */

-    case CURL_SSLVERSION_TLSv1_0:

-      ossl_ssl_version_min = TLS1_VERSION;

-      break;

-    case CURL_SSLVERSION_TLSv1_1:

-      ossl_ssl_version_min = TLS1_1_VERSION;

-      break;

-    case CURL_SSLVERSION_TLSv1_2:

-      ossl_ssl_version_min = TLS1_2_VERSION;

-      break;

-    case CURL_SSLVERSION_TLSv1_3:

+  case CURL_SSLVERSION_TLSv1: /* TLS 1.x */

+  case CURL_SSLVERSION_TLSv1_0:

+    ossl_ssl_version_min = TLS1_VERSION;

+    break;

+  case CURL_SSLVERSION_TLSv1_1:

+    ossl_ssl_version_min = TLS1_1_VERSION;

+    break;

+  case CURL_SSLVERSION_TLSv1_2:

+    ossl_ssl_version_min = TLS1_2_VERSION;

+    break;

+  case CURL_SSLVERSION_TLSv1_3:

 #ifdef TLS1_3_VERSION

-      ossl_ssl_version_min = TLS1_3_VERSION;

-      break;

+    ossl_ssl_version_min = TLS1_3_VERSION;

+    break;

 #else

-      return CURLE_NOT_BUILT_IN;

+    return CURLE_NOT_BUILT_IN;

 #endif

   }

 

@@ -2760,29 +2767,29 @@ set_ssl_version_min_max(struct Curl_cfilter *cf, SSL_CTX *ctx)
 

   /* convert curl max SSL version option to OpenSSL constant */

   switch(curl_ssl_version_max) {

-    case CURL_SSLVERSION_MAX_TLSv1_0:

-      ossl_ssl_version_max = TLS1_VERSION;

-      break;

-    case CURL_SSLVERSION_MAX_TLSv1_1:

-      ossl_ssl_version_max = TLS1_1_VERSION;

-      break;

-    case CURL_SSLVERSION_MAX_TLSv1_2:

-      ossl_ssl_version_max = TLS1_2_VERSION;

-      break;

+  case CURL_SSLVERSION_MAX_TLSv1_0:

+    ossl_ssl_version_max = TLS1_VERSION;

+    break;

+  case CURL_SSLVERSION_MAX_TLSv1_1:

+    ossl_ssl_version_max = TLS1_1_VERSION;

+    break;

+  case CURL_SSLVERSION_MAX_TLSv1_2:

+    ossl_ssl_version_max = TLS1_2_VERSION;

+    break;

 #ifdef TLS1_3_VERSION

-    case CURL_SSLVERSION_MAX_TLSv1_3:

-      ossl_ssl_version_max = TLS1_3_VERSION;

-      break;

+  case CURL_SSLVERSION_MAX_TLSv1_3:

+    ossl_ssl_version_max = TLS1_3_VERSION;

+    break;

 #endif

-    case CURL_SSLVERSION_MAX_NONE:  /* none selected */

-    case CURL_SSLVERSION_MAX_DEFAULT:  /* max selected */

-    default:

-      /* SSL_CTX_set_max_proto_version states that:

-        setting the maximum to 0 will enable

-        protocol versions up to the highest version

-        supported by the library */

-      ossl_ssl_version_max = 0;

-      break;

+  case CURL_SSLVERSION_MAX_NONE:  /* none selected */

+  case CURL_SSLVERSION_MAX_DEFAULT:  /* max selected */

+  default:

+    /* SSL_CTX_set_max_proto_version states that:

+       setting the maximum to 0 will enable

+       protocol versions up to the highest version

+       supported by the library */

+    ossl_ssl_version_max = 0;

+    break;

   }

 

   if(!SSL_CTX_set_max_proto_version(ctx, ossl_ssl_version_max)) {

@@ -2793,7 +2800,7 @@ set_ssl_version_min_max(struct Curl_cfilter *cf, SSL_CTX *ctx)
 }

 #endif

 

-#ifdef OPENSSL_IS_BORINGSSL

+#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)

 typedef uint32_t ctx_option_t;

 #elif OPENSSL_VERSION_NUMBER >= 0x30000000L

 typedef uint64_t ctx_option_t;

@@ -2814,63 +2821,63 @@ set_ssl_version_min_max_legacy(ctx_option_t *ctx_options,
   (void) data; /* In case it's unused. */

 

   switch(ssl_version) {

-    case CURL_SSLVERSION_TLSv1_3:

+  case CURL_SSLVERSION_TLSv1_3:

 #ifdef TLS1_3_VERSION

-    {

-      struct ssl_connect_data *connssl = cf->ctx;

-      DEBUGASSERT(connssl->backend);

-      SSL_CTX_set_max_proto_version(connssl->backend->ctx, TLS1_3_VERSION);

-      *ctx_options |= SSL_OP_NO_TLSv1_2;

-    }

+  {

+    struct ssl_connect_data *connssl = cf->ctx;

+    DEBUGASSERT(connssl->backend);

+    SSL_CTX_set_max_proto_version(connssl->backend->ctx, TLS1_3_VERSION);

+    *ctx_options |= SSL_OP_NO_TLSv1_2;

+  }

 #else

-      (void)ctx_options;

-      failf(data, OSSL_PACKAGE " was built without TLS 1.3 support");

-      return CURLE_NOT_BUILT_IN;

+  (void)ctx_options;

+  failf(data, OSSL_PACKAGE " was built without TLS 1.3 support");

+  return CURLE_NOT_BUILT_IN;

 #endif

-      /* FALLTHROUGH */

-    case CURL_SSLVERSION_TLSv1_2:

+  /* FALLTHROUGH */

+  case CURL_SSLVERSION_TLSv1_2:

 #if OPENSSL_VERSION_NUMBER >= 0x1000100FL

-      *ctx_options |= SSL_OP_NO_TLSv1_1;

+    *ctx_options |= SSL_OP_NO_TLSv1_1;

 #else

-      failf(data, OSSL_PACKAGE " was built without TLS 1.2 support");

-      return CURLE_NOT_BUILT_IN;

+    failf(data, OSSL_PACKAGE " was built without TLS 1.2 support");

+    return CURLE_NOT_BUILT_IN;

 #endif

-      /* FALLTHROUGH */

-    case CURL_SSLVERSION_TLSv1_1:

+    /* FALLTHROUGH */

+  case CURL_SSLVERSION_TLSv1_1:

 #if OPENSSL_VERSION_NUMBER >= 0x1000100FL

-      *ctx_options |= SSL_OP_NO_TLSv1;

+    *ctx_options |= SSL_OP_NO_TLSv1;

 #else

-      failf(data, OSSL_PACKAGE " was built without TLS 1.1 support");

-      return CURLE_NOT_BUILT_IN;

+    failf(data, OSSL_PACKAGE " was built without TLS 1.1 support");

+    return CURLE_NOT_BUILT_IN;

 #endif

-      /* FALLTHROUGH */

-    case CURL_SSLVERSION_TLSv1_0:

-    case CURL_SSLVERSION_TLSv1:

-      break;

+    /* FALLTHROUGH */

+  case CURL_SSLVERSION_TLSv1_0:

+  case CURL_SSLVERSION_TLSv1:

+    break;

   }

 

   switch(ssl_version_max) {

-    case CURL_SSLVERSION_MAX_TLSv1_0:

+  case CURL_SSLVERSION_MAX_TLSv1_0:

 #if OPENSSL_VERSION_NUMBER >= 0x1000100FL

-      *ctx_options |= SSL_OP_NO_TLSv1_1;

+    *ctx_options |= SSL_OP_NO_TLSv1_1;

 #endif

-      /* FALLTHROUGH */

-    case CURL_SSLVERSION_MAX_TLSv1_1:

+    /* FALLTHROUGH */

+  case CURL_SSLVERSION_MAX_TLSv1_1:

 #if OPENSSL_VERSION_NUMBER >= 0x1000100FL

-      *ctx_options |= SSL_OP_NO_TLSv1_2;

+    *ctx_options |= SSL_OP_NO_TLSv1_2;

 #endif

-      /* FALLTHROUGH */

-    case CURL_SSLVERSION_MAX_TLSv1_2:

+    /* FALLTHROUGH */

+  case CURL_SSLVERSION_MAX_TLSv1_2:

 #ifdef TLS1_3_VERSION

-      *ctx_options |= SSL_OP_NO_TLSv1_3;

+    *ctx_options |= SSL_OP_NO_TLSv1_3;

 #endif

-      break;

-    case CURL_SSLVERSION_MAX_TLSv1_3:

+    break;

+  case CURL_SSLVERSION_MAX_TLSv1_3:

 #ifdef TLS1_3_VERSION

-      break;

+    break;

 #else

-      failf(data, OSSL_PACKAGE " was built without TLS 1.3 support");

-      return CURLE_NOT_BUILT_IN;

+    failf(data, OSSL_PACKAGE " was built without TLS 1.3 support");

+    return CURLE_NOT_BUILT_IN;

 #endif

   }

   return CURLE_OK;

@@ -3363,11 +3370,11 @@ CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf,
      or no source is provided and we are falling back to openssl's built-in

      default. */

   cache_criteria_met = (data->set.general_ssl.ca_cache_timeout != 0) &&

-                       conn_config->verifypeer &&

-                       !conn_config->CApath &&

-                       !conn_config->ca_info_blob &&

-                       !ssl_config->primary.CRLfile &&

-                       !ssl_config->native_ca_store;

+    conn_config->verifypeer &&

+    !conn_config->CApath &&

+    !conn_config->ca_info_blob &&

+    !ssl_config->primary.CRLfile &&

+    !ssl_config->native_ca_store;

 

   cached_store = get_cached_x509_store(cf, data);

   if(cached_store && cache_criteria_met && X509_STORE_up_ref(cached_store)) {

@@ -3549,34 +3556,34 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
 #endif

 

   switch(ssl_version) {

-    case CURL_SSLVERSION_SSLv2:

-    case CURL_SSLVERSION_SSLv3:

-      return CURLE_NOT_BUILT_IN;

+  case CURL_SSLVERSION_SSLv2:

+  case CURL_SSLVERSION_SSLv3:

+    return CURLE_NOT_BUILT_IN;

 

     /* "--tlsv<x.y>" options mean TLS >= version <x.y> */

-    case CURL_SSLVERSION_DEFAULT:

-    case CURL_SSLVERSION_TLSv1: /* TLS >= version 1.0 */

-    case CURL_SSLVERSION_TLSv1_0: /* TLS >= version 1.0 */

-    case CURL_SSLVERSION_TLSv1_1: /* TLS >= version 1.1 */

-    case CURL_SSLVERSION_TLSv1_2: /* TLS >= version 1.2 */

-    case CURL_SSLVERSION_TLSv1_3: /* TLS >= version 1.3 */

-      /* asking for any TLS version as the minimum, means no SSL versions

-        allowed */

-      ctx_options |= SSL_OP_NO_SSLv2;

-      ctx_options |= SSL_OP_NO_SSLv3;

+  case CURL_SSLVERSION_DEFAULT:

+  case CURL_SSLVERSION_TLSv1: /* TLS >= version 1.0 */

+  case CURL_SSLVERSION_TLSv1_0: /* TLS >= version 1.0 */

+  case CURL_SSLVERSION_TLSv1_1: /* TLS >= version 1.1 */

+  case CURL_SSLVERSION_TLSv1_2: /* TLS >= version 1.2 */

+  case CURL_SSLVERSION_TLSv1_3: /* TLS >= version 1.3 */

+    /* asking for any TLS version as the minimum, means no SSL versions

+       allowed */

+    ctx_options |= SSL_OP_NO_SSLv2;

+    ctx_options |= SSL_OP_NO_SSLv3;

 

 #if (OPENSSL_VERSION_NUMBER >= 0x10100000L) /* 1.1.0 */

-      result = set_ssl_version_min_max(cf, backend->ctx);

+    result = set_ssl_version_min_max(cf, backend->ctx);

 #else

-      result = set_ssl_version_min_max_legacy(&ctx_options, cf, data);

+    result = set_ssl_version_min_max_legacy(&ctx_options, cf, data);

 #endif

-      if(result != CURLE_OK)

-        return result;

-      break;

+    if(result != CURLE_OK)

+      return result;

+    break;

 

-    default:

-      failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");

-      return CURLE_SSL_CONNECT_ERROR;

+  default:

+    failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");

+    return CURLE_SSL_CONNECT_ERROR;

   }

 

   SSL_CTX_set_options(backend->ctx, ctx_options);

@@ -3693,7 +3700,8 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
    * an internal session cache.

    */

   SSL_CTX_set_session_cache_mode(backend->ctx,

-      SSL_SESS_CACHE_CLIENT | SSL_SESS_CACHE_NO_INTERNAL);

+                                 SSL_SESS_CACHE_CLIENT |

+                                 SSL_SESS_CACHE_NO_INTERNAL);

   SSL_CTX_sess_set_new_cb(backend->ctx, ossl_new_session_cb);

 

   /* give application a chance to interfere with SSL set up. */

@@ -3720,12 +3728,13 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
   SSL_set_app_data(backend->handle, cf);

 

 #if (OPENSSL_VERSION_NUMBER >= 0x0090808fL) && !defined(OPENSSL_NO_TLSEXT) && \

-    !defined(OPENSSL_NO_OCSP)

+  !defined(OPENSSL_NO_OCSP)

   if(conn_config->verifystatus)

     SSL_set_tlsext_status_type(backend->handle, TLSEXT_STATUSTYPE_ocsp);

 #endif

 

-#if defined(OPENSSL_IS_BORINGSSL) && defined(ALLOW_RENEG)

+#if (defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)) && \

+    defined(ALLOW_RENEG)

   SSL_set_renegotiate_mode(backend->handle, ssl_renegotiate_freely);

 #endif

 

@@ -3884,17 +3893,19 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
              error_buffer */

           strcpy(error_buffer, "SSL certificate verification failed");

       }

-#if (OPENSSL_VERSION_NUMBER >= 0x10101000L && \

-    !defined(LIBRESSL_VERSION_NUMBER) && \

-    !defined(OPENSSL_IS_BORINGSSL))

+#if (OPENSSL_VERSION_NUMBER >= 0x10101000L &&   \

+     !defined(LIBRESSL_VERSION_NUMBER) &&       \

+     !defined(OPENSSL_IS_BORINGSSL) &&          \

+     !defined(OPENSSL_IS_AWSLC))

+

       /* SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED is only available on

-         OpenSSL version above v1.1.1, not LibreSSL nor BoringSSL */

+         OpenSSL version above v1.1.1, not LibreSSL, BoringSSL, or AWS-LC */

       else if((lib == ERR_LIB_SSL) &&

               (reason == SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED)) {

-          /* If client certificate is required, communicate the

-             error to client */

-          result = CURLE_SSL_CLIENTCERT;

-          ossl_strerror(errdetail, error_buffer, sizeof(error_buffer));

+        /* If client certificate is required, communicate the

+           error to client */

+        result = CURLE_SSL_CLIENTCERT;

+        ossl_strerror(errdetail, error_buffer, sizeof(error_buffer));

       }

 #endif

       else {

@@ -3939,7 +3950,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
     /* Sets data and len to negotiated protocol, len is 0 if no protocol was

      * negotiated

      */

-    if(cf->conn->bits.tls_enable_alpn) {

+    if(connssl->alpn) {

       const unsigned char *neg_protocol;

       unsigned int len;

       SSL_get0_alpn_selected(backend->handle, &neg_protocol, &len);

@@ -3978,7 +3989,7 @@ static CURLcode pkp_pin_peer_pubkey(struct Curl_easy *data, X509* cert,
     /* Thanks to Viktor Dukhovni on the OpenSSL mailing list */

 

     /* https://groups.google.com/group/mailing.openssl.users/browse_thread

-     /thread/d61858dae102c6c7 */

+       /thread/d61858dae102c6c7 */

     len1 = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), NULL);

     if(len1 < 1)

       break; /* failed */

@@ -4199,7 +4210,7 @@ static CURLcode servercert(struct Curl_cfilter *cf,
   }

 

 #if (OPENSSL_VERSION_NUMBER >= 0x0090808fL) && !defined(OPENSSL_NO_TLSEXT) && \

-    !defined(OPENSSL_NO_OCSP)

+  !defined(OPENSSL_NO_OCSP)

   if(conn_config->verifystatus) {

     result = verifystatus(cf, data);

     if(result) {

@@ -4247,7 +4258,7 @@ static CURLcode ossl_connect_step3(struct Curl_cfilter *cf,
    */

 

   result = servercert(cf, data, conn_config->verifypeer ||

-                                conn_config->verifyhost);

+                      conn_config->verifyhost);

 

   if(!result)

     connssl->connecting_state = ssl_connect_done;

@@ -4433,35 +4444,35 @@ static ssize_t ossl_send(struct Curl_cfilter *cf,
       rc = -1;

       goto out;

     case SSL_ERROR_SYSCALL:

-      {

-        int sockerr = SOCKERRNO;

+    {

+      int sockerr = SOCKERRNO;

 

-        if(backend->io_result == CURLE_AGAIN) {

-          *curlcode = CURLE_AGAIN;

-          rc = -1;

-          goto out;

-        }

-        sslerror = ERR_get_error();

-        if(sslerror)

-          ossl_strerror(sslerror, error_buffer, sizeof(error_buffer));

-        else if(sockerr)

-          Curl_strerror(sockerr, error_buffer, sizeof(error_buffer));

-        else {

-          strncpy(error_buffer, SSL_ERROR_to_str(err), sizeof(error_buffer));

-          error_buffer[sizeof(error_buffer) - 1] = '\0';

-        }

-        failf(data, OSSL_PACKAGE " SSL_write: %s, errno %d",

-              error_buffer, sockerr);

-        *curlcode = CURLE_SEND_ERROR;

+      if(backend->io_result == CURLE_AGAIN) {

+        *curlcode = CURLE_AGAIN;

         rc = -1;

         goto out;

       }

+      sslerror = ERR_get_error();

+      if(sslerror)

+        ossl_strerror(sslerror, error_buffer, sizeof(error_buffer));

+      else if(sockerr)

+        Curl_strerror(sockerr, error_buffer, sizeof(error_buffer));

+      else {

+        strncpy(error_buffer, SSL_ERROR_to_str(err), sizeof(error_buffer));

+        error_buffer[sizeof(error_buffer) - 1] = '\0';

+      }

+      failf(data, OSSL_PACKAGE " SSL_write: %s, errno %d",

+            error_buffer, sockerr);

+      *curlcode = CURLE_SEND_ERROR;

+      rc = -1;

+      goto out;

+    }

     case SSL_ERROR_SSL: {

       /*  A failure in the SSL library occurred, usually a protocol error.

           The OpenSSL error queue contains more information on the error. */

       struct Curl_cfilter *cf_ssl_next = Curl_ssl_cf_get_ssl(cf->next);

       struct ssl_connect_data *connssl_next = cf_ssl_next?

-                                                cf_ssl_next->ctx : NULL;

+        cf_ssl_next->ctx : NULL;

       sslerror = ERR_get_error();

       if(ERR_GET_LIB(sslerror) == ERR_LIB_SSL &&

          ERR_GET_REASON(sslerror) == SSL_R_BIO_NOT_SET &&

@@ -4628,6 +4639,10 @@ static size_t ossl_version(char *buffer, size_t size)
 #else

   return msnprintf(buffer, size, OSSL_PACKAGE);

 #endif

+#elif defined(OPENSSL_IS_AWSLC)

+  return msnprintf(buffer, size, "%s/%s",

+                   OSSL_PACKAGE,

+                   AWSLC_VERSION_NUMBER_STRING);

 #elif defined(HAVE_OPENSSL_VERSION) && defined(OPENSSL_VERSION_STRING)

   return msnprintf(buffer, size, "%s/%s",

                    OSSL_PACKAGE, OpenSSL_version(OPENSSL_VERSION_STRING));

@@ -4714,7 +4729,7 @@ static CURLcode ossl_sha256sum(const unsigned char *tmp, /* input */
 static bool ossl_cert_status_request(void)

 {

 #if (OPENSSL_VERSION_NUMBER >= 0x0090808fL) && !defined(OPENSSL_NO_TLSEXT) && \

-    !defined(OPENSSL_NO_OCSP)

+  !defined(OPENSSL_NO_OCSP)

   return TRUE;

 #else

   return FALSE;

@@ -4728,7 +4743,7 @@ static void *ossl_get_internals(struct ssl_connect_data *connssl,
   struct ssl_backend_data *backend = connssl->backend;

   DEBUGASSERT(backend);

   return info == CURLINFO_TLS_SESSION ?

-         (void *)backend->ctx : (void *)backend->handle;

+    (void *)backend->ctx : (void *)backend->handle;

 }

 

 static void ossl_free_multi_ssl_backend_data(

diff --git a/libs/libcurl/src/vtls/rustls.c b/libs/libcurl/src/vtls/rustls.c
index 923795ff66..36e966eec5 100644
--- a/libs/libcurl/src/vtls/rustls.c
+++ b/libs/libcurl/src/vtls/rustls.c
@@ -102,6 +102,10 @@ read_cb(void *userdata, uint8_t *buf, uintptr_t len, uintptr_t *out_n)
       ret = EINVAL;

   }

   *out_n = (int)nread;

+  /*

+  DEBUGF(LOG_CF(io_ctx->data, io_ctx->cf, "cf->next recv(len=%zu) -> %zd, %d",

+                len, nread, result));

+  */

   return ret;

 }

 

@@ -121,48 +125,30 @@ write_cb(void *userdata, const uint8_t *buf, uintptr_t len, uintptr_t *out_n)
       ret = EINVAL;

   }

   *out_n = (int)nwritten;

+  /*

+  DEBUGF(LOG_CF(io_ctx->data, io_ctx->cf, "cf->next send(len=%zu) -> %zd, %d",

+                len, nwritten, result));

+  */

   return ret;

 }

 

-/*

- * On each run:

- *  - Read a chunk of bytes from the socket into rustls' TLS input buffer.

- *  - Tell rustls to process any new packets.

- *  - Read out as many plaintext bytes from rustls as possible, until hitting

- *    error, EOF, or EAGAIN/EWOULDBLOCK, or plainbuf/plainlen is filled up.

- *

- * It's okay to call this function with plainbuf == NULL and plainlen == 0.

- * In that case, it will copy bytes from the socket into rustls' TLS input

- * buffer, and process packets, but won't consume bytes from rustls' plaintext

- * output buffer.

- */

-static ssize_t

-cr_recv(struct Curl_cfilter *cf, struct Curl_easy *data,

-            char *plainbuf, size_t plainlen, CURLcode *err)

+static ssize_t tls_recv_more(struct Curl_cfilter *cf,

+                             struct Curl_easy *data, CURLcode *err)

 {

   struct ssl_connect_data *const connssl = cf->ctx;

   struct ssl_backend_data *const backend = connssl->backend;

-  struct rustls_connection *rconn = NULL;

   struct io_ctx io_ctx;

-

-  size_t n = 0;

   size_t tls_bytes_read = 0;

-  size_t plain_bytes_copied = 0;

-  rustls_result rresult = 0;

-  char errorbuf[255];

-  size_t errorlen;

   rustls_io_result io_error;

-

-  DEBUGASSERT(backend);

-  rconn = backend->conn;

+  rustls_result rresult = 0;

 

   io_ctx.cf = cf;

   io_ctx.data = data;

-

-  io_error = rustls_connection_read_tls(rconn, read_cb, &io_ctx,

+  io_error = rustls_connection_read_tls(backend->conn, read_cb, &io_ctx,

                                         &tls_bytes_read);

   if(io_error == EAGAIN || io_error == EWOULDBLOCK) {

-    DEBUGF(LOG_CF(data, cf, "cr_recv: EAGAIN or EWOULDBLOCK"));

+    *err = CURLE_AGAIN;

+    return -1;

   }

   else if(io_error) {

     char buffer[STRERROR_LEN];

@@ -172,10 +158,10 @@ cr_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
     return -1;

   }

 

-  DEBUGF(LOG_CF(data, cf, "cr_recv: read %ld TLS bytes", tls_bytes_read));

-

-  rresult = rustls_connection_process_new_packets(rconn);

+  rresult = rustls_connection_process_new_packets(backend->conn);

   if(rresult != RUSTLS_RESULT_OK) {

+    char errorbuf[255];

+    size_t errorlen;

     rustls_error(rresult, errorbuf, sizeof(errorbuf), &errorlen);

     failf(data, "rustls_connection_process_new_packets: %.*s",

       errorlen, errorbuf);

@@ -184,60 +170,102 @@ cr_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
   }

 

   backend->data_pending = TRUE;

+  *err = CURLE_OK;

+  return (ssize_t)tls_bytes_read;

+}

+

+/*

+ * On each run:

+ *  - Read a chunk of bytes from the socket into rustls' TLS input buffer.

+ *  - Tell rustls to process any new packets.

+ *  - Read out as many plaintext bytes from rustls as possible, until hitting

+ *    error, EOF, or EAGAIN/EWOULDBLOCK, or plainbuf/plainlen is filled up.

+ *

+ * It's okay to call this function with plainbuf == NULL and plainlen == 0.

+ * In that case, it will copy bytes from the socket into rustls' TLS input

+ * buffer, and process packets, but won't consume bytes from rustls' plaintext

+ * output buffer.

+ */

+static ssize_t

+cr_recv(struct Curl_cfilter *cf, struct Curl_easy *data,

+            char *plainbuf, size_t plainlen, CURLcode *err)

+{

+  struct ssl_connect_data *const connssl = cf->ctx;

+  struct ssl_backend_data *const backend = connssl->backend;

+  struct rustls_connection *rconn = NULL;

+  size_t n = 0;

+  size_t plain_bytes_copied = 0;

+  rustls_result rresult = 0;

+  ssize_t nread;

+  bool eof = FALSE;

+

+  DEBUGASSERT(backend);

+  rconn = backend->conn;

 

   while(plain_bytes_copied < plainlen) {

+    if(!backend->data_pending) {

+      if(tls_recv_more(cf, data, err) < 0) {

+        if(*err != CURLE_AGAIN) {

+          nread = -1;

+          goto out;

+        }

+        break;

+      }

+    }

+

     rresult = rustls_connection_read(rconn,

       (uint8_t *)plainbuf + plain_bytes_copied,

       plainlen - plain_bytes_copied,

       &n);

     if(rresult == RUSTLS_RESULT_PLAINTEXT_EMPTY) {

-      DEBUGF(LOG_CF(data, cf, "cr_recv: got PLAINTEXT_EMPTY. "

-                    "will try again later."));

       backend->data_pending = FALSE;

-      break;

     }

     else if(rresult == RUSTLS_RESULT_UNEXPECTED_EOF) {

       failf(data, "rustls: peer closed TCP connection "

         "without first closing TLS connection");

       *err = CURLE_READ_ERROR;

-      return -1;

+      nread = -1;

+      goto out;

     }

     else if(rresult != RUSTLS_RESULT_OK) {

       /* n always equals 0 in this case, don't need to check it */

+      char errorbuf[255];

+      size_t errorlen;

       rustls_error(rresult, errorbuf, sizeof(errorbuf), &errorlen);

       failf(data, "rustls_connection_read: %.*s", errorlen, errorbuf);

       *err = CURLE_READ_ERROR;

-      return -1;

+      nread = -1;

+      goto out;

     }

     else if(n == 0) {

       /* n == 0 indicates clean EOF, but we may have read some other

          plaintext bytes before we reached this. Break out of the loop

          so we can figure out whether to return success or EOF. */

+      eof = TRUE;

       break;

     }

     else {

-      DEBUGF(LOG_CF(data, cf, "cr_recv: got %ld plain bytes", n));

       plain_bytes_copied += n;

     }

   }

 

   if(plain_bytes_copied) {

     *err = CURLE_OK;

-    return plain_bytes_copied;

+    nread = (ssize_t)plain_bytes_copied;

   }

-

-  /* If we wrote out 0 plaintext bytes, that means either we hit a clean EOF,

-     OR we got a RUSTLS_RESULT_PLAINTEXT_EMPTY.

-     If the latter, return CURLE_AGAIN so curl doesn't treat this as EOF. */

-  if(!backend->data_pending) {

+  else if(eof) {

+    *err = CURLE_OK;

+    nread = 0;

+  }

+  else {

     *err = CURLE_AGAIN;

-    return -1;

+    nread = -1;

   }

 

-  /* Zero bytes read, and no RUSTLS_RESULT_PLAINTEXT_EMPTY, means the TCP

-     connection was cleanly closed (with a close_notify alert). */

-  *err = CURLE_OK;

-  return 0;

+out:

+  DEBUGF(LOG_CF(data, cf, "cf_recv(len=%zu) -> %zd, %d",

+                plainlen, nread, *err));

+  return nread;

 }

 

 /*

@@ -269,7 +297,10 @@ cr_send(struct Curl_cfilter *cf, struct Curl_easy *data,
   DEBUGASSERT(backend);

   rconn = backend->conn;

 

-  DEBUGF(LOG_CF(data, cf, "cr_send: %ld plain bytes", plainlen));

+  DEBUGF(LOG_CF(data, cf, "cf_send: %ld plain bytes", plainlen));

+

+  io_ctx.cf = cf;

+  io_ctx.data = data;

 

   if(plainlen > 0) {

     rresult = rustls_connection_write(rconn, plainbuf, plainlen,

@@ -287,14 +318,11 @@ cr_send(struct Curl_cfilter *cf, struct Curl_easy *data,
     }

   }

 

-  io_ctx.cf = cf;

-  io_ctx.data = data;

-

   while(rustls_connection_wants_write(rconn)) {

     io_error = rustls_connection_write_tls(rconn, write_cb, &io_ctx,

                                            &tlswritten);

     if(io_error == EAGAIN || io_error == EWOULDBLOCK) {

-      DEBUGF(LOG_CF(data, cf, "cr_send: EAGAIN after %zu bytes",

+      DEBUGF(LOG_CF(data, cf, "cf_send: EAGAIN after %zu bytes",

                     tlswritten_total));

       *err = CURLE_AGAIN;

       return -1;

@@ -311,7 +339,7 @@ cr_send(struct Curl_cfilter *cf, struct Curl_easy *data,
       *err = CURLE_WRITE_ERROR;

       return -1;

     }

-    DEBUGF(LOG_CF(data, cf, "cr_send: wrote %zu TLS bytes", tlswritten));

+    DEBUGF(LOG_CF(data, cf, "cf_send: wrote %zu TLS bytes", tlswritten));

     tlswritten_total += tlswritten;

   }

 

@@ -538,13 +566,12 @@ cr_connect_nonblocking(struct Curl_cfilter *cf,
     if(wants_read) {

       infof(data, "rustls_connection wants us to read_tls.");

 

-      cr_recv(cf, data, NULL, 0, &tmperr);

-      if(tmperr == CURLE_AGAIN) {

-        infof(data, "reading would block");

-        /* fall through */

-      }

-      else if(tmperr != CURLE_OK) {

-        if(tmperr == CURLE_READ_ERROR) {

+      if(tls_recv_more(cf, data, &tmperr) < 0) {

+        if(tmperr == CURLE_AGAIN) {

+          infof(data, "reading would block");

+          /* fall through */

+        }

+        else if(tmperr == CURLE_READ_ERROR) {

           return CURLE_SSL_CONNECT_ERROR;

         }

         else {

diff --git a/libs/libcurl/src/vtls/schannel.c b/libs/libcurl/src/vtls/schannel.c
index 63f9b07690..68cead586b 100644
--- a/libs/libcurl/src/vtls/schannel.c
+++ b/libs/libcurl/src/vtls/schannel.c
@@ -1171,9 +1171,11 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
   if(!backend->cred) {

     char *snihost;

     result = schannel_acquire_credential_handle(cf, data);

-    if(result != CURLE_OK) {

+    if(result)

       return result;

-    }

+    /* schannel_acquire_credential_handle() sets backend->cred accordingly or

+       it returns error otherwise. */

+

     /* A hostname associated with the credential is needed by

        InitializeSecurityContext for SNI and other reasons. */

     snihost = Curl_ssl_snihost(data, hostname, NULL);

@@ -2356,7 +2358,7 @@ schannel_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
                "schannel: decrypted data buffer: offset %zu length %zu",

                backend->decdata_offset, backend->decdata_length));

 

-  cleanup:

+cleanup:

   /* Warning- there is no guarantee the encdata state is valid at this point */

   DEBUGF(infof(data, "schannel: schannel_recv cleanup"));

 

diff --git a/libs/libcurl/src/vtls/sectransp.c b/libs/libcurl/src/vtls/sectransp.c
index 81ab9ab061..b718c84adf 100644
--- a/libs/libcurl/src/vtls/sectransp.c
+++ b/libs/libcurl/src/vtls/sectransp.c
@@ -45,6 +45,11 @@
 #pragma clang diagnostic ignored "-Wtautological-pointer-compare"

 #endif /* __clang__ */

 

+#ifdef __GNUC__

+#pragma GCC diagnostic ignored "-Waddress"

+#pragma GCC diagnostic ignored "-Wundef"

+#endif

+

 #include <limits.h>

 

 #include <Security/Security.h>

@@ -234,7 +239,7 @@ struct st_cipher {
    insert in between existing items to appropriate place based on

    cipher suite IANA number

 */

-const static struct st_cipher ciphertable[] = {

+static const struct st_cipher ciphertable[] = {

   /* SSL version 3.0 and initial TLS 1.0 cipher suites.

      Defined since SDK 10.2.8 */

   CIPHER_DEF_SSLTLS(NULL_WITH_NULL_NULL,                           /* 0x0000 */

@@ -900,12 +905,12 @@ CF_INLINE const char *TLSCipherNameForNumber(SSLCipherSuite cipher)
   /* The first ciphers in the ciphertable are continuous. Here we do small

      optimization and instead of loop directly get SSL name by cipher number.

   */

+  size_t i;

   if(cipher <= SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA) {

     return ciphertable[cipher].name;

   }

   /* Iterate through the rest of the ciphers */

-  for(size_t i = SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA + 1;

-      i < NUM_OF_CIPHERS;

+  for(i = SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA + 1; i < NUM_OF_CIPHERS;

       ++i) {

     if(ciphertable[i].num == cipher) {

       return ciphertable[i].name;

@@ -1429,7 +1434,8 @@ static CURLcode set_ssl_version_min_max(struct Curl_cfilter *cf,
 

 static bool is_cipher_suite_strong(SSLCipherSuite suite_num)

 {

-  for(size_t i = 0; i < NUM_OF_CIPHERS; ++i) {

+  size_t i;

+  for(i = 0; i < NUM_OF_CIPHERS; ++i) {

     if(ciphertable[i].num == suite_num) {

       return !ciphertable[i].weak;

     }

@@ -1545,16 +1551,17 @@ static CURLcode sectransp_set_selected_ciphers(struct Curl_easy *data,
     size_t cipher_len = 0;

     const char *cipher_end = NULL;

     bool tls_name = FALSE;

+    size_t i;

 

     /* Skip separators */

     while(is_separator(*cipher_start))

-       cipher_start++;

+      cipher_start++;

     if(*cipher_start == '\0') {

       break;

     }

     /* Find last position of a cipher in the ciphers string */

     cipher_end = cipher_start;

-    while (*cipher_end != '\0' && !is_separator(*cipher_end)) {

+    while(*cipher_end != '\0' && !is_separator(*cipher_end)) {

       ++cipher_end;

     }

 

@@ -1568,7 +1575,7 @@ static CURLcode sectransp_set_selected_ciphers(struct Curl_easy *data,
     /* Iterate through the cipher table and look for the cipher, starting

        the cipher number 0x01 because the 0x00 is not the real cipher */

     cipher_len = cipher_end - cipher_start;

-    for(size_t i = 1; i < NUM_OF_CIPHERS; ++i) {

+    for(i = 1; i < NUM_OF_CIPHERS; ++i) {

       const char *table_cipher_name = NULL;

       if(tls_name) {

         table_cipher_name = ciphertable[i].name;

@@ -2712,7 +2719,7 @@ check_handshake:
         failf(data, "Peer rejected unexpected message");

         break;

 #if CURL_BUILD_MAC_10_11 || CURL_BUILD_IOS_9

-      /* Treaing non-fatal error as fatal like before */

+      /* Treating non-fatal error as fatal like before */

       case errSSLClientHelloReceived:

         failf(data, "A non-fatal result for providing a server name "

                     "indication");

@@ -2796,7 +2803,7 @@ check_handshake:
     }

 

 #if(CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1

-    if(cf->conn->bits.tls_enable_alpn) {

+    if(connssl->alpn) {

       if(__builtin_available(macOS 10.13.4, iOS 11, tvOS 11, *)) {

         CFArrayRef alpnArr = NULL;

         CFStringRef chosenProtocol = NULL;

@@ -3376,7 +3383,7 @@ static ssize_t sectransp_recv(struct Curl_cfilter *cf,
 

   DEBUGASSERT(backend);

 

-  again:

+again:

   *curlcode = CURLE_OK;

   err = SSLRead(backend->ssl_ctx, buf, buffersize, &processed);

 

diff --git a/libs/libcurl/src/vtls/vtls.c b/libs/libcurl/src/vtls/vtls.c
index 1f618d9aac..5068bc2aaf 100644
--- a/libs/libcurl/src/vtls/vtls.c
+++ b/libs/libcurl/src/vtls/vtls.c
@@ -130,6 +130,33 @@ static bool blobcmp(struct curl_blob *first, struct curl_blob *second)
   return !memcmp(first->data, second->data, first->len); /* same data */

 }

 

+#ifdef USE_SSL

+static const struct alpn_spec ALPN_SPEC_H10 = {

+  { ALPN_HTTP_1_0 }, 1

+};

+static const struct alpn_spec ALPN_SPEC_H11 = {

+  { ALPN_HTTP_1_1 }, 1

+};

+#ifdef USE_HTTP2

+static const struct alpn_spec ALPN_SPEC_H2_H11 = {

+  { ALPN_H2, ALPN_HTTP_1_1 }, 2

+};

+#endif

+

+static const struct alpn_spec *alpn_get_spec(int httpwant, bool use_alpn)

+{

+  if(!use_alpn)

+    return NULL;

+  if(httpwant == CURL_HTTP_VERSION_1_0)

+    return &ALPN_SPEC_H10;

+#ifdef USE_HTTP2

+  if(httpwant >= CURL_HTTP_VERSION_2)

+    return &ALPN_SPEC_H2_H11;

+#endif

+  return &ALPN_SPEC_H11;

+}

+#endif /* USE_SSL */

+

 

 bool

 Curl_ssl_config_matches(struct ssl_primary_config *data,

@@ -291,7 +318,7 @@ static bool ssl_prefs_check(struct Curl_easy *data)
 }

 

 static struct ssl_connect_data *cf_ctx_new(struct Curl_easy *data,

-                                           const struct alpn_spec *alpn)

+                                     const struct alpn_spec *alpn)

 {

   struct ssl_connect_data *ctx;

 

@@ -754,20 +781,6 @@ CURLcode Curl_ssl_push_certinfo_len(struct Curl_easy *data,
   return result;

 }

 

-/*

- * This is a convenience function for push_certinfo_len that takes a zero

- * terminated value.

- */

-CURLcode Curl_ssl_push_certinfo(struct Curl_easy *data,

-                                int certnum,

-                                const char *label,

-                                const char *value)

-{

-  size_t valuelen = strlen(value);

-

-  return Curl_ssl_push_certinfo_len(data, certnum, label, value, valuelen);

-}

-

 CURLcode Curl_ssl_random(struct Curl_easy *data,

                          unsigned char *entropy,

                          size_t length)

@@ -1581,8 +1594,15 @@ static ssize_t ssl_cf_recv(struct Curl_cfilter *cf,
   ssize_t nread;

 

   CF_DATA_SAVE(save, cf, data);

-  *err = CURLE_OK;

   nread = Curl_ssl->recv_plain(cf, data, buf, len, err);

+  if(nread > 0) {

+    DEBUGASSERT((size_t)nread <= len);

+  }

+  else if(nread == 0) {

+    /* eof */

+    *err = CURLE_OK;

+  }

+  DEBUGF(LOG_CF(data, cf, "cf_recv(len=%zu) -> %zd, %d", len, nread, *err));

   CF_DATA_RESTORE(cf, save);

   return nread;

 }

@@ -1726,7 +1746,8 @@ static CURLcode cf_ssl_create(struct Curl_cfilter **pcf,
 

   DEBUGASSERT(data->conn);

 

-  ctx = cf_ctx_new(data, Curl_alpn_get_spec(data, conn));

+  ctx = cf_ctx_new(data, alpn_get_spec(data->state.httpwant,

+                                       conn->bits.tls_enable_alpn));

   if(!ctx) {

     result = CURLE_OUT_OF_MEMORY;

     goto out;

@@ -1767,6 +1788,7 @@ CURLcode Curl_cf_ssl_insert_after(struct Curl_cfilter *cf_at,
 }

 

 #ifndef CURL_DISABLE_PROXY

+

 static CURLcode cf_ssl_proxy_create(struct Curl_cfilter **pcf,

                                     struct Curl_easy *data,

                                     struct connectdata *conn)

@@ -1774,8 +1796,17 @@ static CURLcode cf_ssl_proxy_create(struct Curl_cfilter **pcf,
   struct Curl_cfilter *cf = NULL;

   struct ssl_connect_data *ctx;

   CURLcode result;

+  bool use_alpn = conn->bits.tls_enable_alpn;

+  int httpwant = CURL_HTTP_VERSION_1_1;

+

+#ifdef USE_HTTP2

+  if(conn->http_proxy.proxytype == CURLPROXY_HTTPS2) {

+    use_alpn = TRUE;

+    httpwant = CURL_HTTP_VERSION_2;

+  }

+#endif

 

-  ctx = cf_ctx_new(data, Curl_alpn_get_proxy_spec(data, conn));

+  ctx = cf_ctx_new(data, alpn_get_spec(httpwant, use_alpn));

   if(!ctx) {

     result = CURLE_OUT_OF_MEMORY;

     goto out;

@@ -1789,19 +1820,6 @@ out:
   return result;

 }

 

-CURLcode Curl_ssl_cfilter_proxy_add(struct Curl_easy *data,

-                                    struct connectdata *conn,

-                                    int sockindex)

-{

-  struct Curl_cfilter *cf;

-  CURLcode result;

-

-  result = cf_ssl_proxy_create(&cf, data, conn);

-  if(!result)

-    Curl_conn_cf_add(data, conn, sockindex, cf);

-  return result;

-}

-

 CURLcode Curl_cf_ssl_proxy_insert_after(struct Curl_cfilter *cf_at,

                                         struct Curl_easy *data)

 {

@@ -1844,15 +1862,16 @@ void *Curl_ssl_get_internals(struct Curl_easy *data, int sockindex,
 CURLcode Curl_ssl_cfilter_remove(struct Curl_easy *data,

                                  int sockindex)

 {

-  struct Curl_cfilter *cf = data->conn? data->conn->cfilter[sockindex] : NULL;

+  struct Curl_cfilter *cf, *head;

   CURLcode result = CURLE_OK;

 

   (void)data;

-  for(; cf; cf = cf->next) {

+  head = data->conn? data->conn->cfilter[sockindex] : NULL;

+  for(cf = head; cf; cf = cf->next) {

     if(cf->cft == &Curl_cft_ssl) {

       if(Curl_ssl->shut_down(cf, data))

         result = CURLE_SSL_SHUTDOWN_FAILED;

-      Curl_conn_cf_discard(cf, data);

+      Curl_conn_cf_discard_sub(head, cf, data, FALSE);

       break;

     }

   }

@@ -1914,19 +1933,6 @@ Curl_ssl_cf_get_primary_config(struct Curl_cfilter *cf)
 #endif

 }

 

-struct ssl_primary_config *

-Curl_ssl_get_primary_config(struct Curl_easy *data,

-                            struct connectdata *conn,

-                            int sockindex)

-{

-  struct Curl_cfilter *cf;

-

-  (void)data;

-  DEBUGASSERT(conn);

-  cf = get_ssl_cf_engaged(conn, sockindex);

-  return cf? Curl_ssl_cf_get_primary_config(cf) : NULL;

-}

-

 struct Curl_cfilter *Curl_ssl_cf_get_ssl(struct Curl_cfilter *cf)

 {

   for(; cf; cf = cf->next) {

@@ -1936,42 +1942,6 @@ struct Curl_cfilter *Curl_ssl_cf_get_ssl(struct Curl_cfilter *cf)
   return NULL;

 }

 

-static const struct alpn_spec ALPN_SPEC_H10 = {

-  { ALPN_HTTP_1_0 }, 1

-};

-static const struct alpn_spec ALPN_SPEC_H11 = {

-  { ALPN_HTTP_1_1 }, 1

-};

-#ifdef USE_HTTP2

-static const struct alpn_spec ALPN_SPEC_H2_H11 = {

-  { ALPN_H2, ALPN_HTTP_1_1 }, 2

-};

-#endif

-

-const struct alpn_spec *

-Curl_alpn_get_spec(struct Curl_easy *data, struct connectdata *conn)

-{

-  if(!conn->bits.tls_enable_alpn)

-    return NULL;

-  if(data->state.httpwant == CURL_HTTP_VERSION_1_0)

-    return &ALPN_SPEC_H10;

-#ifdef USE_HTTP2

-  if(data->state.httpwant >= CURL_HTTP_VERSION_2)

-    return &ALPN_SPEC_H2_H11;

-#endif

-  return &ALPN_SPEC_H11;

-}

-

-const struct alpn_spec *

-Curl_alpn_get_proxy_spec(struct Curl_easy *data, struct connectdata *conn)

-{

-  if(!conn->bits.tls_enable_alpn)

-    return NULL;

-  if(data->state.httpwant == CURL_HTTP_VERSION_1_0)

-    return &ALPN_SPEC_H10;

-  return &ALPN_SPEC_H11;

-}

-

 CURLcode Curl_alpn_to_proto_buf(struct alpn_proto_buf *buf,

                                 const struct alpn_spec *spec)

 {

@@ -2006,7 +1976,7 @@ CURLcode Curl_alpn_to_proto_str(struct alpn_proto_buf *buf,
     len = strlen(spec->entries[i]);

     if(len >= ALPN_NAME_MAX)

       return CURLE_FAILED_INIT;

-    if(off + len + 2 >= (int)sizeof(buf->data))

+    if(off + len + 2 >= sizeof(buf->data))

       return CURLE_FAILED_INIT;

     if(off)

       buf->data[off++] = ',';

@@ -2024,32 +1994,40 @@ CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,
                                   size_t proto_len)

 {

   int can_multi = 0;

+  unsigned char *palpn =

+#ifndef CURL_DISABLE_PROXY

+    (cf->conn->bits.tunnel_proxy && Curl_ssl_cf_is_proxy(cf))?

+    &cf->conn->proxy_alpn : &cf->conn->alpn

+#else

+    &cf->conn->alpn

+#endif

+    ;

 

   if(proto && proto_len) {

     if(proto_len == ALPN_HTTP_1_1_LENGTH &&

-            !memcmp(ALPN_HTTP_1_1, proto, ALPN_HTTP_1_1_LENGTH)) {

-      cf->conn->alpn = CURL_HTTP_VERSION_1_1;

+       !memcmp(ALPN_HTTP_1_1, proto, ALPN_HTTP_1_1_LENGTH)) {

+      *palpn = CURL_HTTP_VERSION_1_1;

     }

     else if(proto_len == ALPN_HTTP_1_0_LENGTH &&

             !memcmp(ALPN_HTTP_1_0, proto, ALPN_HTTP_1_0_LENGTH)) {

-      cf->conn->alpn = CURL_HTTP_VERSION_1_0;

+      *palpn = CURL_HTTP_VERSION_1_0;

     }

 #ifdef USE_HTTP2

     else if(proto_len == ALPN_H2_LENGTH &&

             !memcmp(ALPN_H2, proto, ALPN_H2_LENGTH)) {

-      cf->conn->alpn = CURL_HTTP_VERSION_2;

+      *palpn = CURL_HTTP_VERSION_2;

       can_multi = 1;

     }

 #endif

 #ifdef USE_HTTP3

     else if(proto_len == ALPN_H3_LENGTH &&

-       !memcmp(ALPN_H3, proto, ALPN_H3_LENGTH)) {

-      cf->conn->alpn = CURL_HTTP_VERSION_3;

+            !memcmp(ALPN_H3, proto, ALPN_H3_LENGTH)) {

+      *palpn = CURL_HTTP_VERSION_3;

       can_multi = 1;

     }

 #endif

     else {

-      cf->conn->alpn = CURL_HTTP_VERSION_NONE;

+      *palpn = CURL_HTTP_VERSION_NONE;

       failf(data, "unsupported ALPN protocol: '%.*s'", (int)proto_len, proto);

       /* TODO: do we want to fail this? Previous code just ignored it and

        * some vtls backends even ignore the return code of this function. */

@@ -2059,12 +2037,14 @@ CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,
     infof(data, VTLS_INFOF_ALPN_ACCEPTED_LEN_1STR, (int)proto_len, proto);

   }

   else {

-    cf->conn->alpn = CURL_HTTP_VERSION_NONE;

+    *palpn = CURL_HTTP_VERSION_NONE;

     infof(data, VTLS_INFOF_NO_ALPN);

   }

 

 out:

-  Curl_multiuse_state(data, can_multi? BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);

+  if(!Curl_ssl_cf_is_proxy(cf))

+    Curl_multiuse_state(data, can_multi?

+                        BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);

   return CURLE_OK;

 }

 

diff --git a/libs/libcurl/src/vtls/vtls.h b/libs/libcurl/src/vtls/vtls.h
index bb59ecbe9c..2178e8834f 100644
--- a/libs/libcurl/src/vtls/vtls.h
+++ b/libs/libcurl/src/vtls/vtls.h
@@ -65,58 +65,6 @@ CURLsslset Curl_init_sslset_nolock(curl_sslbackend id, const char *name,
 #define CURL_SHA256_DIGEST_LENGTH 32 /* fixed size */

 #endif

 

-/* see https://www.iana.org/assignments/tls-extensiontype-values/ */

-#define ALPN_HTTP_1_1_LENGTH 8

-#define ALPN_HTTP_1_1 "http/1.1"

-#define ALPN_HTTP_1_0_LENGTH 8

-#define ALPN_HTTP_1_0 "http/1.0"

-#define ALPN_H2_LENGTH 2

-#define ALPN_H2 "h2"

-#define ALPN_H3_LENGTH 2

-#define ALPN_H3 "h3"

-

-/* conservative sizes on the ALPN entries and count we are handling,

- * we can increase these if we ever feel the need or have to accommodate

- * ALPN strings from the "outside". */

-#define ALPN_NAME_MAX     10

-#define ALPN_ENTRIES_MAX  3

-#define ALPN_PROTO_BUF_MAX   (ALPN_ENTRIES_MAX * (ALPN_NAME_MAX + 1))

-

-struct alpn_spec {

-  const char entries[ALPN_ENTRIES_MAX][ALPN_NAME_MAX];

-  size_t count; /* number of entries */

-};

-

-struct alpn_proto_buf {

-  unsigned char data[ALPN_PROTO_BUF_MAX];

-  int len;

-};

-

-CURLcode Curl_alpn_to_proto_buf(struct alpn_proto_buf *buf,

-                                const struct alpn_spec *spec);

-CURLcode Curl_alpn_to_proto_str(struct alpn_proto_buf *buf,

-                                const struct alpn_spec *spec);

-

-CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,

-                                  struct Curl_easy *data,

-                                  const unsigned char *proto,

-                                  size_t proto_len);

-

-/**

- * Get the ALPN specification to use for talking to remote host.

- * May return NULL if ALPN is disabled on the connection.

- */

-const struct alpn_spec *

-Curl_alpn_get_spec(struct Curl_easy *data, struct connectdata *conn);

-

-/**

- * Get the ALPN specification to use for talking to the proxy.

- * May return NULL if ALPN is disabled on the connection.

- */

-const struct alpn_spec *

-Curl_alpn_get_proxy_spec(struct Curl_easy *data, struct connectdata *conn);

-

-

 char *Curl_ssl_snihost(struct Curl_easy *data, const char *host, size_t *olen);

 bool Curl_ssl_config_matches(struct ssl_primary_config *data,

                              struct ssl_primary_config *needle);

@@ -207,9 +155,6 @@ CURLcode Curl_ssl_cfilter_remove(struct Curl_easy *data,
                                  int sockindex);

 

 #ifndef CURL_DISABLE_PROXY

-CURLcode Curl_ssl_cfilter_proxy_add(struct Curl_easy *data,

-                                    struct connectdata *conn,

-                                    int sockindex);

 CURLcode Curl_cf_ssl_proxy_insert_after(struct Curl_cfilter *cf_at,

                                         struct Curl_easy *data);

 #endif /* !CURL_DISABLE_PROXY */

@@ -227,20 +172,6 @@ struct ssl_config_data *Curl_ssl_get_config(struct Curl_easy *data,
                                             int sockindex);

 

 /**

- * Get the primary SSL configuration from the connection.

- * This returns NULL if no SSL is configured.

- * Otherwise it returns the config of the first (highest) one that is

- * either connected, in handshake or about to start

- * (e.g. all filters below it are connected). If SSL filters are present,

- * but neither can start operating, return the config of the lowest one

- * that will first come into effect when connecting.

- */

-struct ssl_primary_config *

-Curl_ssl_get_primary_config(struct Curl_easy *data,

-                            struct connectdata *conn,

-                            int sockindex);

-

-/**

  * True iff the underlying SSL implementation supports the option.

  * Option is one of the defined SSLSUPP_* values.

  * `data` maybe NULL for the features of the default implementation.

@@ -278,7 +209,6 @@ extern struct Curl_cftype Curl_cft_ssl_proxy;
 #define Curl_ssl_get_internals(a,b,c,d) NULL

 #define Curl_ssl_supports(a,b) FALSE

 #define Curl_ssl_cfilter_add(a,b,c) CURLE_NOT_BUILT_IN

-#define Curl_ssl_cfilter_proxy_add(a,b,c) CURLE_NOT_BUILT_IN

 #define Curl_ssl_get_config(a,b) NULL

 #define Curl_ssl_cfilter_remove(a,b) CURLE_OK

 #endif

diff --git a/libs/libcurl/src/vtls/vtls_int.h b/libs/libcurl/src/vtls/vtls_int.h
index a9b16f8b2c..31b57fd37a 100644
--- a/libs/libcurl/src/vtls/vtls_int.h
+++ b/libs/libcurl/src/vtls/vtls_int.h
@@ -29,17 +29,55 @@
 

 #ifdef USE_SSL

 

+/* see https://www.iana.org/assignments/tls-extensiontype-values/ */

+#define ALPN_HTTP_1_1_LENGTH 8

+#define ALPN_HTTP_1_1 "http/1.1"

+#define ALPN_HTTP_1_0_LENGTH 8

+#define ALPN_HTTP_1_0 "http/1.0"

+#define ALPN_H2_LENGTH 2

+#define ALPN_H2 "h2"

+#define ALPN_H3_LENGTH 2

+#define ALPN_H3 "h3"

+

+/* conservative sizes on the ALPN entries and count we are handling,

+ * we can increase these if we ever feel the need or have to accommodate

+ * ALPN strings from the "outside". */

+#define ALPN_NAME_MAX     10

+#define ALPN_ENTRIES_MAX  3

+#define ALPN_PROTO_BUF_MAX   (ALPN_ENTRIES_MAX * (ALPN_NAME_MAX + 1))

+

+struct alpn_spec {

+  const char entries[ALPN_ENTRIES_MAX][ALPN_NAME_MAX];

+  size_t count; /* number of entries */

+};

+

+struct alpn_proto_buf {

+  unsigned char data[ALPN_PROTO_BUF_MAX];

+  int len;

+};

+

+CURLcode Curl_alpn_to_proto_buf(struct alpn_proto_buf *buf,

+                                const struct alpn_spec *spec);

+CURLcode Curl_alpn_to_proto_str(struct alpn_proto_buf *buf,

+                                const struct alpn_spec *spec);

+

+CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,

+                                  struct Curl_easy *data,

+                                  const unsigned char *proto,

+                                  size_t proto_len);

+

 /* Information in each SSL cfilter context: cf->ctx */

 struct ssl_connect_data {

   ssl_connection_state state;

   ssl_connect_state connecting_state;

   char *hostname;                   /* hostname for verification */

   char *dispname;                   /* display version of hostname */

-  int port;                         /* remote port at origin */

   const struct alpn_spec *alpn;     /* ALPN to use or NULL for none */

   struct ssl_backend_data *backend; /* vtls backend specific props */

   struct cf_call_data call_data;    /* data handle used in current call */

   struct curltime handshake_done;   /* time when handshake finished */

+  int port;                         /* remote port at origin */

+  BIT(use_alpn);                    /* if ALPN shall be used in handshake */

 };

 

 

diff --git a/libs/libcurl/src/vtls/wolfssl.c b/libs/libcurl/src/vtls/wolfssl.c
index 8918e3554a..5ed483815b 100644
--- a/libs/libcurl/src/vtls/wolfssl.c
+++ b/libs/libcurl/src/vtls/wolfssl.c
@@ -854,7 +854,7 @@ wolfssl_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
   }

 

 #ifdef HAVE_ALPN

-  if(cf->conn->bits.tls_enable_alpn) {

+  if(connssl->alpn) {

     int rc;

     char *protocol = NULL;

     unsigned short protocol_len = 0;

diff --git a/libs/libcurl/src/vtls/x509asn1.c b/libs/libcurl/src/vtls/x509asn1.c
index cf673b349f..58feb58226 100644
--- a/libs/libcurl/src/vtls/x509asn1.c
+++ b/libs/libcurl/src/vtls/x509asn1.c
@@ -172,7 +172,7 @@ static const struct Curl_OID OIDtable[] = {
  * It is intended to support certificate information gathering for SSL backends

  * that offer a mean to get certificates as a whole, but do not supply

  * entry points to get particular certificate sub-fields.

- * Please note there is no pretention here to rewrite a full SSL library.

+ * Please note there is no pretension here to rewrite a full SSL library.

  */

 

 static const char *getASN1Element(struct Curl_asn1Element *elem,

@@ -918,6 +918,20 @@ static const char *dumpAlgo(struct Curl_asn1Element *param,
   return OID2str(oid.beg, oid.end, TRUE);

 }

 

+/*

+ * This is a convenience function for push_certinfo_len that takes a zero

+ * terminated value.

+ */

+static CURLcode ssl_push_certinfo(struct Curl_easy *data,

+                                  int certnum,

+                                  const char *label,

+                                  const char *value)

+{

+  size_t valuelen = strlen(value);

+

+  return Curl_ssl_push_certinfo_len(data, certnum, label, value, valuelen);

+}

+

 /* return 0 on success, 1 on error */

 static int do_pubkey_field(struct Curl_easy *data, int certnum,

                            const char *label, struct Curl_asn1Element *elem)

@@ -930,7 +944,7 @@ static int do_pubkey_field(struct Curl_easy *data, int certnum,
   output = ASN1tostr(elem, 0);

   if(output) {

     if(data->set.ssl.certinfo)

-      result = Curl_ssl_push_certinfo(data, certnum, label, output);

+      result = ssl_push_certinfo(data, certnum, label, output);

     if(!certnum && !result)

       infof(data, "   %s: %s", label, output);

     free((char *) output);

@@ -960,7 +974,7 @@ static int do_pubkey(struct Curl_easy *data, int certnum,
     if(data->set.ssl.certinfo) {

       char q[sizeof(len) * 8 / 3 + 1];

       (void)msnprintf(q, sizeof(q), "%lu", len);

-      if(Curl_ssl_push_certinfo(data, certnum, "ECC Public Key", q))

+      if(ssl_push_certinfo(data, certnum, "ECC Public Key", q))

         return 1;

     }

     return do_pubkey_field(data, certnum, "ecPublicKey", pubkey);

@@ -994,7 +1008,7 @@ static int do_pubkey(struct Curl_easy *data, int certnum,
     if(data->set.ssl.certinfo) {

       char r[sizeof(len) * 8 / 3 + 1];

       msnprintf(r, sizeof(r), "%lu", len);

-      if(Curl_ssl_push_certinfo(data, certnum, "RSA Public Key", r))

+      if(ssl_push_certinfo(data, certnum, "RSA Public Key", r))

         return 1;

     }

     /* Generate coefficients. */

@@ -1092,7 +1106,7 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data,
   if(!ccp)

     return CURLE_OUT_OF_MEMORY;

   if(data->set.ssl.certinfo) {

-    result = Curl_ssl_push_certinfo(data, certnum, "Subject", ccp);

+    result = ssl_push_certinfo(data, certnum, "Subject", ccp);

     if(result)

       return result;

   }

@@ -1105,7 +1119,7 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data,
   if(!ccp)

     return CURLE_OUT_OF_MEMORY;

   if(data->set.ssl.certinfo) {

-    result = Curl_ssl_push_certinfo(data, certnum, "Issuer", ccp);

+    result = ssl_push_certinfo(data, certnum, "Issuer", ccp);

   }

   if(!certnum)

     infof(data, "   Issuer: %s", ccp);

@@ -1121,7 +1135,7 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data,
     ccp = curl_maprintf("%x", version);

     if(!ccp)

       return CURLE_OUT_OF_MEMORY;

-    result = Curl_ssl_push_certinfo(data, certnum, "Version", ccp);

+    result = ssl_push_certinfo(data, certnum, "Version", ccp);

     free((char *) ccp);

     if(result)

       return result;

@@ -1134,7 +1148,7 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data,
   if(!ccp)

     return CURLE_OUT_OF_MEMORY;

   if(data->set.ssl.certinfo)

-    result = Curl_ssl_push_certinfo(data, certnum, "Serial Number", ccp);

+    result = ssl_push_certinfo(data, certnum, "Serial Number", ccp);

   if(!certnum)

     infof(data, "   Serial Number: %s", ccp);

   free((char *) ccp);

@@ -1147,7 +1161,7 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data,
   if(!ccp)

     return CURLE_OUT_OF_MEMORY;

   if(data->set.ssl.certinfo)

-    result = Curl_ssl_push_certinfo(data, certnum, "Signature Algorithm", ccp);

+    result = ssl_push_certinfo(data, certnum, "Signature Algorithm", ccp);

   if(!certnum)

     infof(data, "   Signature Algorithm: %s", ccp);

   free((char *) ccp);

@@ -1159,7 +1173,7 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data,
   if(!ccp)

     return CURLE_OUT_OF_MEMORY;

   if(data->set.ssl.certinfo)

-    result = Curl_ssl_push_certinfo(data, certnum, "Start Date", ccp);

+    result = ssl_push_certinfo(data, certnum, "Start Date", ccp);

   if(!certnum)

     infof(data, "   Start Date: %s", ccp);

   free((char *) ccp);

@@ -1171,7 +1185,7 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data,
   if(!ccp)

     return CURLE_OUT_OF_MEMORY;

   if(data->set.ssl.certinfo)

-    result = Curl_ssl_push_certinfo(data, certnum, "Expire Date", ccp);

+    result = ssl_push_certinfo(data, certnum, "Expire Date", ccp);

   if(!certnum)

     infof(data, "   Expire Date: %s", ccp);

   free((char *) ccp);

@@ -1184,7 +1198,7 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data,
   if(!ccp)

     return CURLE_OUT_OF_MEMORY;

   if(data->set.ssl.certinfo)

-    result = Curl_ssl_push_certinfo(data, certnum, "Public Key Algorithm",

+    result = ssl_push_certinfo(data, certnum, "Public Key Algorithm",

                                     ccp);

   if(!result) {

     int ret;

@@ -1203,7 +1217,7 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data,
   if(!ccp)

     return CURLE_OUT_OF_MEMORY;

   if(data->set.ssl.certinfo)

-    result = Curl_ssl_push_certinfo(data, certnum, "Signature", ccp);

+    result = ssl_push_certinfo(data, certnum, "Signature", ccp);

   if(!certnum)

     infof(data, "   Signature: %s", ccp);

   free((char *) ccp);

@@ -1238,7 +1252,7 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data,
   cp2[i] = '\0';

   free(cp1);

   if(data->set.ssl.certinfo)

-    result = Curl_ssl_push_certinfo(data, certnum, "Cert", cp2);

+    result = ssl_push_certinfo(data, certnum, "Cert", cp2);

   if(!certnum)

     infof(data, "%s", cp2);

   free(cp2);