libcurl: update to 8.11.1

6 files changed, 63 insertions, 258 deletions

diff --git a/libs/libcurl/src/vtls/mbedtls.c b/libs/libcurl/src/vtls/mbedtls.c
index 20226b74bd..ae2acdb0a0 100644
--- a/libs/libcurl/src/vtls/mbedtls.c
+++ b/libs/libcurl/src/vtls/mbedtls.c
@@ -54,7 +54,7 @@
 #  ifdef MBEDTLS_DEBUG

 #    include <mbedtls/debug.h>

 #  endif

-#endif

+#endif /* MBEDTLS_VERSION_MAJOR >= 2 */

 

 #include "cipher_suite.h"

 #include "strcase.h"

@@ -122,7 +122,7 @@ struct mbed_ssl_backend_data {
 #define HAS_SESSION_TICKETS

 #endif

 

-#if defined(THREADING_SUPPORT)

+#ifdef THREADING_SUPPORT

 static mbedtls_entropy_context ts_entropy;

 

 static int entropy_init_initialized = 0;

@@ -585,16 +585,6 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
     return CURLE_NOT_BUILT_IN;

   }

 

-#ifdef TLS13_SUPPORT

-  ret = psa_crypto_init();

-  if(ret != PSA_SUCCESS) {

-    mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));

-    failf(data, "mbedTLS psa_crypto_init returned (-0x%04X) %s",

-          -ret, errorbuf);

-    return CURLE_SSL_CONNECT_ERROR;

-  }

-#endif /* TLS13_SUPPORT */

-

 #ifdef THREADING_SUPPORT

   mbedtls_ctr_drbg_init(&backend->ctr_drbg);

 

@@ -1571,6 +1561,20 @@ static int mbedtls_init(void)
 #ifdef THREADING_SUPPORT

   entropy_init_mutex(&ts_entropy);

 #endif

+#ifdef TLS13_SUPPORT

+  {

+    int ret;

+#ifdef THREADING_SUPPORT

+    Curl_mbedtlsthreadlock_lock_function(0);

+#endif

+    ret = psa_crypto_init();

+#ifdef THREADING_SUPPORT

+    Curl_mbedtlsthreadlock_unlock_function(0);

+#endif

+    if(ret != PSA_SUCCESS)

+      return 0;

+  }

+#endif /* TLS13_SUPPORT */

   return 1;

 }

 

diff --git a/libs/libcurl/src/vtls/openssl.c b/libs/libcurl/src/vtls/openssl.c
index 86931089b1..ed4dd5df1f 100644
--- a/libs/libcurl/src/vtls/openssl.c
+++ b/libs/libcurl/src/vtls/openssl.c
@@ -83,7 +83,7 @@
 #include <openssl/evp.h>

 

 #ifdef USE_ECH

-# ifndef OPENSSL_IS_BORINGSSL

+# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)

 #  include <openssl/ech.h>

 # endif

 # include "curl_base64.h"

@@ -1152,9 +1152,8 @@ static bool is_pkcs11_uri(const char *string)
 

 static CURLcode ossl_set_engine(struct Curl_easy *data, const char *engine);

 

-static int

-SSL_CTX_use_certificate_blob(SSL_CTX *ctx, const struct curl_blob *blob,

-                             int type, const char *key_passwd)

+static int use_certificate_blob(SSL_CTX *ctx, const struct curl_blob *blob,

+                                int type, const char *key_passwd)

 {

   int ret = 0;

   X509 *x = NULL;

@@ -1190,9 +1189,8 @@ end:
   return ret;

 }

 

-static int

-SSL_CTX_use_PrivateKey_blob(SSL_CTX *ctx, const struct curl_blob *blob,

-                            int type, const char *key_passwd)

+static int use_privatekey_blob(SSL_CTX *ctx, const struct curl_blob *blob,

+                               int type, const char *key_passwd)

 {

   int ret = 0;

   EVP_PKEY *pkey = NULL;

@@ -1205,14 +1203,12 @@ SSL_CTX_use_PrivateKey_blob(SSL_CTX *ctx, const struct curl_blob *blob,
                                    (void *)key_passwd);

   else if(type == SSL_FILETYPE_ASN1)

     pkey = d2i_PrivateKey_bio(in, NULL);

-  else {

-    ret = 0;

+  else

     goto end;

-  }

-  if(!pkey) {

-    ret = 0;

+

+  if(!pkey)

     goto end;

-  }

+

   ret = SSL_CTX_use_PrivateKey(ctx, pkey);

   EVP_PKEY_free(pkey);

 end:

@@ -1221,8 +1217,8 @@ end:
 }

 

 static int

-SSL_CTX_use_certificate_chain_blob(SSL_CTX *ctx, const struct curl_blob *blob,

-                                   const char *key_passwd)

+use_certificate_chain_blob(SSL_CTX *ctx, const struct curl_blob *blob,

+                           const char *key_passwd)

 {

 /* SSL_CTX_add1_chain_cert introduced in OpenSSL 1.0.2 */

 #if (OPENSSL_VERSION_NUMBER >= 0x1000200fL) && /* OpenSSL 1.0.2 or later */ \

@@ -1239,11 +1235,8 @@ SSL_CTX_use_certificate_chain_blob(SSL_CTX *ctx, const struct curl_blob *blob,
 

   x = PEM_read_bio_X509_AUX(in, NULL,

                             passwd_callback, (void *)key_passwd);

-

-  if(!x) {

-    ret = 0;

+  if(!x)

     goto end;

-  }

 

   ret = SSL_CTX_use_certificate(ctx, x);

 

@@ -1324,7 +1317,7 @@ int cert_stuff(struct Curl_easy *data,
     case SSL_FILETYPE_PEM:

       /* SSL_CTX_use_certificate_chain_file() only works on PEM files */

       cert_use_result = cert_blob ?

-        SSL_CTX_use_certificate_chain_blob(ctx, cert_blob, key_passwd) :

+        use_certificate_chain_blob(ctx, cert_blob, key_passwd) :

         SSL_CTX_use_certificate_chain_file(ctx, cert_file);

       if(cert_use_result != 1) {

         failf(data,

@@ -1344,8 +1337,7 @@ int cert_stuff(struct Curl_easy *data,
          ASN1 files. */

 

       cert_use_result = cert_blob ?

-        SSL_CTX_use_certificate_blob(ctx, cert_blob,

-                                     file_type, key_passwd) :

+        use_certificate_blob(ctx, cert_blob, file_type, key_passwd) :

       SSL_CTX_use_certificate_file(ctx, cert_file, file_type);

       if(cert_use_result != 1) {

         failf(data,

@@ -1554,7 +1546,7 @@ fail:
       FALLTHROUGH();

     case SSL_FILETYPE_ASN1:

       cert_use_result = key_blob ?

-        SSL_CTX_use_PrivateKey_blob(ctx, key_blob, file_type, key_passwd) :

+        use_privatekey_blob(ctx, key_blob, file_type, key_passwd) :

       SSL_CTX_use_PrivateKey_file(ctx, key_file, file_type);

       if(cert_use_result != 1) {

         failf(data, "unable to set private key file: '%s' type %s",

@@ -3674,14 +3666,14 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
   SSL_CTX_set_mode(octx->ssl_ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);

 #endif

 

-#ifdef HAS_ALPN

   if(alpn && alpn_len) {

+#ifdef HAS_ALPN

     if(SSL_CTX_set_alpn_protos(octx->ssl_ctx, alpn, (int)alpn_len)) {

       failf(data, "Error setting ALPN");

       return CURLE_SSL_CONNECT_ERROR;

     }

-  }

 #endif

+  }

 

   if(ssl_cert || ssl_cert_blob || ssl_cert_type) {

     if(!result &&

@@ -3849,15 +3841,15 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
 

     if(data->set.tls_ech & CURLECH_GREASE) {

       infof(data, "ECH: will GREASE ClientHello");

-# ifdef OPENSSL_IS_BORINGSSL

+# if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)

       SSL_set_enable_ech_grease(octx->ssl, 1);

 # else

       SSL_set_options(octx->ssl, SSL_OP_ECH_GREASE);

 # endif

     }

     else if(data->set.tls_ech & CURLECH_CLA_CFG) {

-# ifdef OPENSSL_IS_BORINGSSL

-      /* have to do base64 decode here for boring */

+# if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)

+      /* have to do base64 decode here for BoringSSL */

       const char *b64 = data->set.str[STRING_ECH_CONFIG];

 

       if(!b64) {

@@ -3917,7 +3909,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
           size_t elen = rinfo->echconfiglist_len;

 

           infof(data, "ECH: ECHConfig from DoH HTTPS RR");

-# ifndef OPENSSL_IS_BORINGSSL

+# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)

           if(SSL_ech_set1_echconfig(octx->ssl, ecl, elen) != 1) {

             infof(data, "ECH: SSL_ECH_set1_echconfig failed");

             if(data->set.tls_ech & CURLECH_HARD)

@@ -3925,7 +3917,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
           }

 # else

           if(SSL_set1_ech_config_list(octx->ssl, ecl, elen) != 1) {

-            infof(data, "ECH: SSL_set1_ech_config_list failed (boring)");

+            infof(data, "ECH: SSL_set1_ech_config_list failed (BoringSSL)");

             if(data->set.tls_ech & CURLECH_HARD)

               return CURLE_SSL_CONNECT_ERROR;

           }

@@ -3943,7 +3935,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
         Curl_resolv_unlink(data, &dns);

       }

     }

-# ifdef OPENSSL_IS_BORINGSSL

+# if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)

     if(trying_ech_now && outername) {

       infof(data, "ECH: setting public_name not supported with BoringSSL");

       return CURLE_SSL_CONNECT_ERROR;

@@ -3960,7 +3952,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
         return CURLE_SSL_CONNECT_ERROR;

       }

     }

-# endif  /* not BORING */

+# endif  /* OPENSSL_IS_BORINGSSL || OPENSSL_IS_AWSLC */

     if(trying_ech_now

        && SSL_set_min_proto_version(octx->ssl, TLS1_3_VERSION) != 1) {

       infof(data, "ECH: cannot force TLSv1.3 [ERROR]");

@@ -4071,7 +4063,7 @@ static void ossl_trace_ech_retry_configs(struct Curl_easy *data, SSL* ssl,
   CURLcode result = CURLE_OK;

   size_t rcl = 0;

   int rv = 1;

-# ifndef OPENSSL_IS_BORINGSSL

+# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)

   char *inner = NULL;

   unsigned char *rcs = NULL;

   char *outer = NULL;

@@ -4086,7 +4078,7 @@ static void ossl_trace_ech_retry_configs(struct Curl_easy *data, SSL* ssl,
   /* nothing to trace if not doing ECH */

   if(!ECH_ENABLED(data))

     return;

-# ifndef OPENSSL_IS_BORINGSSL

+# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)

   rv = SSL_ech_get_retry_config(ssl, &rcs, &rcl);

 # else

   SSL_get0_ech_retry_configs(ssl, &rcs, &rcl);

@@ -4103,23 +4095,23 @@ static void ossl_trace_ech_retry_configs(struct Curl_easy *data, SSL* ssl,
     if(!result && b64str)

       infof(data, "ECH: retry_configs %s", b64str);

     free(b64str);

-# ifndef OPENSSL_IS_BORINGSSL

+# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)

     rv = SSL_ech_get_status(ssl, &inner, &outer);

     infof(data, "ECH: retry_configs for %s from %s, %d %d",

           inner ? inner : "NULL", outer ? outer : "NULL", reason, rv);

-#else

+# else

     rv = SSL_ech_accepted(ssl);

     servername_type = SSL_get_servername_type(ssl);

     inner = SSL_get_servername(ssl, servername_type);

     SSL_get0_ech_name_override(ssl, &outer, &out_name_len);

-    /* TODO: get the inner from boring */

+    /* TODO: get the inner from BoringSSL */

     infof(data, "ECH: retry_configs for %s from %s, %d %d",

           inner ? inner : "NULL", outer ? outer : "NULL", reason, rv);

-#endif

+# endif

   }

   else

     infof(data, "ECH: no retry_configs (rv = %d)", rv);

-# ifndef OPENSSL_IS_BORINGSSL

+# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)

   OPENSSL_free((void *)rcs);

 # endif

   return;

@@ -4220,14 +4212,11 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
         lerr = SSL_get_verify_result(octx->ssl);

         if(lerr != X509_V_OK) {

           ssl_config->certverifyresult = lerr;

-          msnprintf(error_buffer, sizeof(error_buffer),

-                    "SSL certificate problem: %s",

-                    X509_verify_cert_error_string(lerr));

+          failf(data, "SSL certificate problem: %s",

+                X509_verify_cert_error_string(lerr));

         }

-        else {

+        else

           failf(data, "%s", "SSL certificate verification failed");

-          return result;

-        }

       }

 #if defined(SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED)

       /* SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED is only available on

@@ -4243,7 +4232,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
 #endif

 #ifdef USE_ECH

       else if((lib == ERR_LIB_SSL) &&

-# ifndef OPENSSL_IS_BORINGSSL

+# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)

               (reason == SSL_R_ECH_REQUIRED)) {

 # else

               (reason == SSL_R_ECH_REJECTED)) {

@@ -4278,7 +4267,6 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
         failf(data, OSSL_PACKAGE " SSL_connect: %s in connection to %s:%d ",

               extramsg[0] ? extramsg : SSL_ERROR_to_str(detail),

               connssl->peer.hostname, connssl->peer.port);

-        return result;

       }

 

       return result;

@@ -4309,7 +4297,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
           OBJ_nid2sn(psigtype_nid));

 

 #ifdef USE_ECH

-# ifndef OPENSSL_IS_BORINGSSL

+# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)

     if(ECH_ENABLED(data)) {

       char *inner = NULL, *outer = NULL;

       const char *status = NULL;

@@ -4367,7 +4355,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
    else {

       infof(data, "ECH: result: status is not attempted");

    }

-# endif  /* BORING */

+# endif  /* !OPENSSL_IS_BORINGSSL && !OPENSSL_IS_AWSLC */

 #endif  /* USE_ECH */

 

 #ifdef HAS_ALPN

diff --git a/libs/libcurl/src/vtls/schannel.c b/libs/libcurl/src/vtls/schannel.c
index 85d018d322..1c9ecc673a 100644
--- a/libs/libcurl/src/vtls/schannel.c
+++ b/libs/libcurl/src/vtls/schannel.c
@@ -451,11 +451,6 @@ get_cert_location(TCHAR *path, DWORD *store_name, TCHAR **store_path,
 }

 #endif

 

-static bool algo(const char *check, char *namep, size_t nlen)

-{

-  return (strlen(check) == nlen) && !strncmp(check, namep, nlen);

-}

-

 static CURLcode

 schannel_acquire_credential_handle(struct Curl_cfilter *cf,

                                    struct Curl_easy *data)

@@ -781,187 +776,14 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
      curlx_verify_windows_version(10, 0, 17763, PLATFORM_WINNT,

                                   VERSION_GREATER_THAN_EQUAL)) {

 

-    char *ciphers13 = 0;

-

-    bool disable_aes_gcm_sha384 = FALSE;

-    bool disable_aes_gcm_sha256 = FALSE;

-    bool disable_chacha_poly = FALSE;

-    bool disable_aes_ccm_8_sha256 = FALSE;

-    bool disable_aes_ccm_sha256 = FALSE;

-

     SCH_CREDENTIALS credentials = { 0 };

     TLS_PARAMETERS tls_parameters = { 0 };

-    CRYPTO_SETTINGS crypto_settings[4] = { { 0 } };

-    UNICODE_STRING blocked_ccm_modes[1] = { { 0 } };

-    UNICODE_STRING blocked_gcm_modes[1] = { { 0 } };

-

-    int crypto_settings_idx = 0;

-

-

-    /* If TLS 1.3 ciphers are explicitly listed, then

-     * disable all the ciphers and re-enable which

-     * ciphers the user has provided.

-     */

-    ciphers13 = conn_config->cipher_list13;

-    if(ciphers13) {

-      const int remaining_ciphers = 5;

-

-      /* detect which remaining ciphers to enable

-         and then disable everything else.

-      */

-

-      char *startCur = ciphers13;

-      int algCount = 0;

-      char *nameEnd;

-

-      disable_aes_gcm_sha384 = TRUE;

-      disable_aes_gcm_sha256 = TRUE;

-      disable_chacha_poly = TRUE;

-      disable_aes_ccm_8_sha256 = TRUE;

-      disable_aes_ccm_sha256 = TRUE;

-

-      while(startCur && (0 != *startCur) && (algCount < remaining_ciphers)) {

-        size_t n;

-        char *namep;

-        nameEnd = strchr(startCur, ':');

-        n = nameEnd ? (size_t)(nameEnd - startCur) : strlen(startCur);

-        namep = startCur;

-

-        if(disable_aes_gcm_sha384 &&

-           algo("TLS_AES_256_GCM_SHA384", namep, n)) {

-          disable_aes_gcm_sha384 = FALSE;

-        }

-        else if(disable_aes_gcm_sha256

-                && algo("TLS_AES_128_GCM_SHA256", namep, n)) {

-          disable_aes_gcm_sha256 = FALSE;

-        }

-        else if(disable_chacha_poly

-                && algo("TLS_CHACHA20_POLY1305_SHA256", namep, n)) {

-          disable_chacha_poly = FALSE;

-        }

-        else if(disable_aes_ccm_8_sha256

-                && algo("TLS_AES_128_CCM_8_SHA256", namep, n)) {

-          disable_aes_ccm_8_sha256 = FALSE;

-        }

-        else if(disable_aes_ccm_sha256

-                && algo("TLS_AES_128_CCM_SHA256", namep, n)) {

-          disable_aes_ccm_sha256 = FALSE;

-        }

-        else {

-          failf(data, "schannel: Unknown TLS 1.3 cipher: %.*s", (int)n, namep);

-          return CURLE_SSL_CIPHER;

-        }

-

-        startCur = nameEnd;

-        if(startCur)

-          startCur++;

-

-        algCount++;

-      }

-    }

-

-    if(disable_aes_gcm_sha384 && disable_aes_gcm_sha256

-       && disable_chacha_poly && disable_aes_ccm_8_sha256

-       && disable_aes_ccm_sha256) {

-      failf(data, "schannel: All available TLS 1.3 ciphers were disabled");

-      return CURLE_SSL_CIPHER;

-    }

-

-    /* Disable TLS_AES_128_CCM_8_SHA256 and/or TLS_AES_128_CCM_SHA256 */

-    if(disable_aes_ccm_8_sha256 || disable_aes_ccm_sha256) {

-      /*

-        Disallow AES_CCM algorithm.

-      */

-      blocked_ccm_modes[0].Length = sizeof(BCRYPT_CHAIN_MODE_CCM);

-      blocked_ccm_modes[0].MaximumLength = sizeof(BCRYPT_CHAIN_MODE_CCM);

-      blocked_ccm_modes[0].Buffer = (PWSTR)BCRYPT_CHAIN_MODE_CCM;

-

-      crypto_settings[crypto_settings_idx].eAlgorithmUsage =

-        TlsParametersCngAlgUsageCipher;

-      crypto_settings[crypto_settings_idx].rgstrChainingModes =

-        blocked_ccm_modes;

-      crypto_settings[crypto_settings_idx].cChainingModes =

-        ARRAYSIZE(blocked_ccm_modes);

-      crypto_settings[crypto_settings_idx].strCngAlgId.Length =

-        sizeof(BCRYPT_AES_ALGORITHM);

-      crypto_settings[crypto_settings_idx].strCngAlgId.MaximumLength =

-        sizeof(BCRYPT_AES_ALGORITHM);

-      crypto_settings[crypto_settings_idx].strCngAlgId.Buffer =

-        (PWSTR)BCRYPT_AES_ALGORITHM;

-

-      /* only disabling one of the CCM modes */

-      if(disable_aes_ccm_8_sha256 != disable_aes_ccm_sha256) {

-        if(disable_aes_ccm_8_sha256)

-          crypto_settings[crypto_settings_idx].dwMinBitLength = 128;

-        else /* disable_aes_ccm_sha256 */

-          crypto_settings[crypto_settings_idx].dwMaxBitLength = 64;

-      }

-

-      crypto_settings_idx++;

-    }

-

-    /* Disable TLS_AES_256_GCM_SHA384 and/or TLS_AES_128_GCM_SHA256 */

-    if(disable_aes_gcm_sha384 || disable_aes_gcm_sha256) {

-

-      /*

-        Disallow AES_GCM algorithm

-      */

-      blocked_gcm_modes[0].Length = sizeof(BCRYPT_CHAIN_MODE_GCM);

-      blocked_gcm_modes[0].MaximumLength = sizeof(BCRYPT_CHAIN_MODE_GCM);

-      blocked_gcm_modes[0].Buffer = (PWSTR)BCRYPT_CHAIN_MODE_GCM;

-

-      /* if only one is disabled, then explicitly disable the

-         digest cipher suite (sha384 or sha256) */

-      if(disable_aes_gcm_sha384 != disable_aes_gcm_sha256) {

-        crypto_settings[crypto_settings_idx].eAlgorithmUsage =

-          TlsParametersCngAlgUsageDigest;

-        crypto_settings[crypto_settings_idx].strCngAlgId.Length =

-          sizeof(disable_aes_gcm_sha384 ?

-                 BCRYPT_SHA384_ALGORITHM : BCRYPT_SHA256_ALGORITHM);

-        crypto_settings[crypto_settings_idx].strCngAlgId.MaximumLength =

-          sizeof(disable_aes_gcm_sha384 ?

-                 BCRYPT_SHA384_ALGORITHM : BCRYPT_SHA256_ALGORITHM);

-        crypto_settings[crypto_settings_idx].strCngAlgId.Buffer =

-          (PWSTR)(disable_aes_gcm_sha384 ?

-                  BCRYPT_SHA384_ALGORITHM : BCRYPT_SHA256_ALGORITHM);

-      }

-      else { /* Disable both AES_GCM ciphers */

-        crypto_settings[crypto_settings_idx].eAlgorithmUsage =

-          TlsParametersCngAlgUsageCipher;

-        crypto_settings[crypto_settings_idx].strCngAlgId.Length =

-          sizeof(BCRYPT_AES_ALGORITHM);

-        crypto_settings[crypto_settings_idx].strCngAlgId.MaximumLength =

-          sizeof(BCRYPT_AES_ALGORITHM);

-        crypto_settings[crypto_settings_idx].strCngAlgId.Buffer =

-          (PWSTR)BCRYPT_AES_ALGORITHM;

-      }

-

-      crypto_settings[crypto_settings_idx].rgstrChainingModes =

-        blocked_gcm_modes;

-      crypto_settings[crypto_settings_idx].cChainingModes = 1;

-

-      crypto_settings_idx++;

-    }

-

-    /*

-      Disable ChaCha20-Poly1305.

-    */

-    if(disable_chacha_poly) {

-      crypto_settings[crypto_settings_idx].eAlgorithmUsage =

-        TlsParametersCngAlgUsageCipher;

-      crypto_settings[crypto_settings_idx].strCngAlgId.Length =

-        sizeof(BCRYPT_CHACHA20_POLY1305_ALGORITHM);

-      crypto_settings[crypto_settings_idx].strCngAlgId.MaximumLength =

-        sizeof(BCRYPT_CHACHA20_POLY1305_ALGORITHM);

-      crypto_settings[crypto_settings_idx].strCngAlgId.Buffer =

-        (PWSTR)BCRYPT_CHACHA20_POLY1305_ALGORITHM;

-      crypto_settings_idx++;

-    }

+    CRYPTO_SETTINGS crypto_settings[1] = { { 0 } };

 

     tls_parameters.pDisabledCrypto = crypto_settings;

 

     /* The number of blocked suites */

-    tls_parameters.cDisabledCrypto = (DWORD)crypto_settings_idx;

+    tls_parameters.cDisabledCrypto = (DWORD)0;

     credentials.pTlsParameters = &tls_parameters;

     credentials.cTlsParameters = 1;

 

@@ -986,9 +808,8 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
                                          &backend->cred->time_stamp);

   }

   else {

-    /* Pre-Windows 10 1809 or the user set a legacy algorithm list. Although MS

-       does not document it, currently Schannel will not negotiate TLS 1.3 when

-       SCHANNEL_CRED is used. */

+    /* Pre-Windows 10 1809 or the user set a legacy algorithm list.

+       Schannel will not negotiate TLS 1.3 when SCHANNEL_CRED is used. */

     ALG_ID algIds[NUM_CIPHERS];

     char *ciphers = conn_config->cipher_list;

     SCHANNEL_CRED schannel_cred = { 0 };

@@ -998,16 +819,10 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
 

     if(ciphers) {

       if((enabled_protocols & SP_PROT_TLS1_3_CLIENT)) {

-        infof(data, "schannel: WARNING: This version of Schannel may "

-              "negotiate a less-secure TLS version than TLS 1.3 because the "

+        infof(data, "schannel: WARNING: This version of Schannel "

+              "negotiates a less-secure TLS version than TLS 1.3 because the "

               "user set an algorithm cipher list.");

       }

-      if(conn_config->cipher_list13) {

-        failf(data, "schannel: This version of Schannel does not support "

-              "setting an algorithm cipher list and TLS 1.3 cipher list at "

-              "the same time");

-        return CURLE_SSL_CIPHER;

-      }

       result = set_ssl_ciphers(&schannel_cred, ciphers, algIds);

       if(CURLE_OK != result) {

         failf(data, "schannel: Failed setting algorithm cipher list");

@@ -2974,7 +2789,6 @@ const struct Curl_ssl Curl_ssl_schannel = {
 #ifndef CURL_WINDOWS_UWP

   SSLSUPP_PINNEDPUBKEY |

 #endif

-  SSLSUPP_TLS13_CIPHERSUITES |

   SSLSUPP_CA_CACHE |

   SSLSUPP_HTTPS_PROXY |

   SSLSUPP_CIPHER_LIST,

diff --git a/libs/libcurl/src/vtls/schannel_verify.c b/libs/libcurl/src/vtls/schannel_verify.c
index ee960ed2c5..42f7f517e4 100644
--- a/libs/libcurl/src/vtls/schannel_verify.c
+++ b/libs/libcurl/src/vtls/schannel_verify.c
@@ -554,7 +554,7 @@ CURLcode Curl_verify_host(struct Curl_cfilter *cf,
     }

   }

 

-  if(p->size) {

+  if(p->size && alt_name_info) {

     for(i = 0; i < alt_name_info->cAltEntry; ++i) {

       PCERT_ALT_NAME_ENTRY entry = &alt_name_info->rgAltEntry[i];

       if(entry->dwAltNameChoice == CERT_ALT_NAME_IP_ADDRESS) {

@@ -571,7 +571,6 @@ CURLcode Curl_verify_host(struct Curl_cfilter *cf,
       }

     }

   }

-

   else {

     /* Determine the size of the string needed for the cert hostname */

     len = cert_get_name_string(data, pCertContextServer,

diff --git a/libs/libcurl/src/vtls/sectransp.c b/libs/libcurl/src/vtls/sectransp.c
index bf1d44dbdf..765ce36d92 100644
--- a/libs/libcurl/src/vtls/sectransp.c
+++ b/libs/libcurl/src/vtls/sectransp.c
@@ -354,8 +354,8 @@ CF_INLINE void GetDarwinVersionNumber(int *major, int *minor)
   }

 

   /* Parse the version: */

-  os_version_major = strtok_r(os_version, ".", &tok_buf);

-  os_version_minor = strtok_r(NULL, ".", &tok_buf);

+  os_version_major = Curl_strtok_r(os_version, ".", &tok_buf);

+  os_version_minor = Curl_strtok_r(NULL, ".", &tok_buf);

   *major = atoi(os_version_major);

   *minor = atoi(os_version_minor);

   free(os_version);

diff --git a/libs/libcurl/src/vtls/wolfssl.c b/libs/libcurl/src/vtls/wolfssl.c
index 9a05f82946..a624d3ff0c 100644
--- a/libs/libcurl/src/vtls/wolfssl.c
+++ b/libs/libcurl/src/vtls/wolfssl.c
@@ -33,8 +33,8 @@
 #ifdef USE_WOLFSSL

 

 #define WOLFSSL_OPTIONS_IGNORE_SYS

-#include <wolfssl/version.h>

 #include <wolfssl/options.h>

+#include <wolfssl/version.h>

 

 #if LIBWOLFSSL_VERSION_HEX < 0x03004006 /* wolfSSL 3.4.6 (2015) */

 #error "wolfSSL version should be at least 3.4.6"