80 changed files with 14825 additions and 4840 deletions
--- a/.curl.metadata
+++ b/.curl.metadata
@ -1 +1 @@
-d38ab79ef7a6d92df91ca8dfcf9a5eaf7e25b725 SOURCES/curl-7.76.1.tar.xz
+8b56123714b4e061f0f71005c5be598b12f82483 SOURCES/curl-7.61.1.tar.xz
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/curl-7.76.1.tar.xz
+SOURCES/curl-7.61.1.tar.xz
--- a/SOURCES/0001-curl-7.61.1-test320-gnutls.patch
+++ b/SOURCES/0001-curl-7.61.1-test320-gnutls.patch
@ -0,0 +1,63 @@
 From 3cd5b375e31fb98e4782dc3a77e7316ad9eb26cf Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 4 Oct 2018 15:34:13 +0200
 Subject: [PATCH] test320: strip out more HTML when comparing
 To make the test case work with different gnutls-serv versions better.
 Reported-by: Kamil Dudka
 Fixes #3093
 Closes #3094
 Upstream-commit: 94ad57b0246b5658c2a9139dbe6a80efa4c4e2f3
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/data/test320 | 24 ++++--------------------
 1 file changed, 4 insertions(+), 20 deletions(-)
 diff --git a/tests/data/test320 b/tests/data/test320
 index 457a11eb2..87311d4f2 100644
 --- a/tests/data/test320
 +++ b/tests/data/test320
@@ -62,34 +62,18 @@ simple TLS-SRP HTTPS GET, check user in response
 HTTP/1.0 200 OK
 Content-type: text/html
 -
 -<HTML><BODY>
 -<CENTER><H1>This is <a href="http://www.gnu.org/software/gnutls">GnuTLS</a></H1></CENTER>
 -
 -
 -
 -<h5>If your browser supports session resuming, then you should see the same session ID, when you press the <b>reload</b> button.</h5>
 -<p>Connected as user 'jsmith'.</p>
 -<P>
 -<TABLE border=1><TR><TD></TD></TR>
 -<TR><TD>Key Exchange:</TD><TD>SRP</TD></TR>
 -<TR><TD>Compression</TD><TD>NULL</TD></TR>
 -<TR><TD>Cipher</TD><TD>AES-NNN-CBC</TD></TR>
 -<TR><TD>MAC</TD><TD>SHA1</TD></TR>
 -<TR><TD>Ciphersuite</TD><TD>SRP_SHA_AES_NNN_CBC_SHA1</TD></TR></p></TABLE>
 -<hr><P>Your HTTP header was:<PRE>Host: %HOSTIP:%HTTPTLSPORT
 +FINE
 User-Agent: curl-test-suite
 Accept: */*
 -</PRE></P>
 -</BODY></HTML>
 -
 </file>
 <stripfile>
 -s/^<p>Session ID:.*//
 +s/^<p>Connected as user 'jsmith'.*/FINE/
 s/Protocol version:.*[0-9]//
 s/GNUTLS/GnuTLS/
 s/(AES[-_])\d\d\d([-_]CBC)/$1NNN$2/
 +s/^<.*\n//
 +s/^\n//
 </stripfile>
 </verify>
 -- 
 2.17.1
--- a/SOURCES/0001-curl-7.76.1-resource-leaks.patch
+++ b/SOURCES/0001-curl-7.76.1-resource-leaks.patch
@ -1,133 +0,0 @@
 From 2281afef6757ed66c9e8a9a737aa91cb9e2950ef Mon Sep 17 00:00:00 2001
 From: Kamil Dudka <kdudka@redhat.com>
 Date: Fri, 30 Apr 2021 18:14:45 +0200
 Subject: [PATCH 1/2] http2: fix resource leaks in set_transfer_url()
 ... detected by Coverity:
 Error: RESOURCE_LEAK (CWE-772):
 lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.]
 lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()".
 lib/http2.c:486: noescape: Resource "u" is not freed or pointed-to in "curl_url_set". [Note: The source code implementation of the function has been overridden by a builtin model.]
 lib/http2.c:488: leaked_storage: Variable "u" going out of scope leaks the storage it points to.
 Error: RESOURCE_LEAK (CWE-772):
 lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.]
 lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()".
 lib/http2.c:493: noescape: Resource "u" is not freed or pointed-to in "curl_url_set". [Note: The source code implementation of the function has been overridden by a builtin model.]
 lib/http2.c:495: leaked_storage: Variable "u" going out of scope leaks the storage it points to.
 Error: RESOURCE_LEAK (CWE-772):
 lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.]
 lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()".
 lib/http2.c:500: noescape: Resource "u" is not freed or pointed-to in "curl_url_set". [Note: The source code implementation of the function has been overridden by a builtin model.]
 lib/http2.c:502: leaked_storage: Variable "u" going out of scope leaks the storage it points to.
 Error: RESOURCE_LEAK (CWE-772):
 lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.]
 lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()".
 lib/http2.c:505: noescape: Resource "u" is not freed or pointed-to in "curl_url_get". [Note: The source code implementation of the function has been overridden by a builtin model.]
 lib/http2.c:507: leaked_storage: Variable "u" going out of scope leaks the storage it points to.
 Closes #6986
 Upstream-commit: 31931704707324af4b4edb24cc877829f7e9949e
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/http2.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)
 diff --git a/lib/http2.c b/lib/http2.c
 index ce9a0d3..d5ba89b 100644
 --- a/lib/http2.c
 +++ b/lib/http2.c
@@ -500,32 +500,42 @@ static int set_transfer_url(struct Curl_easy *data,
   CURLU *u = curl_url();
   CURLUcode uc;
   char *url;
 +  int rc = 0;
   v = curl_pushheader_byname(hp, ":scheme");
   if(v) {
     uc = curl_url_set(u, CURLUPART_SCHEME, v, 0);
 -    if(uc)
 -      return 1;
 +    if(uc) {
 +      rc = 1;
 +      goto fail;
 +    }
   }
   v = curl_pushheader_byname(hp, ":authority");
   if(v) {
     uc = curl_url_set(u, CURLUPART_HOST, v, 0);
 -    if(uc)
 -      return 2;
 +    if(uc) {
 +      rc = 2;
 +      goto fail;
 +    }
   }
   v = curl_pushheader_byname(hp, ":path");
   if(v) {
     uc = curl_url_set(u, CURLUPART_PATH, v, 0);
 -    if(uc)
 -      return 3;
 +    if(uc) {
 +      rc = 3;
 +      goto fail;
 +    }
   }
   uc = curl_url_get(u, CURLUPART_URL, &url, 0);
   if(uc)
 -    return 4;
 +    rc = 4;
 +  fail:
   curl_url_cleanup(u);
 +  if(rc)
 +    return rc;
   if(data->state.url_alloc)
     free(data->state.url);
 -- 
 2.30.2
 From 92ad72983f8462be1d5a5228672657ddf4d7ed72 Mon Sep 17 00:00:00 2001
 From: Kamil Dudka <kdudka@redhat.com>
 Date: Fri, 30 Apr 2021 18:18:02 +0200
 Subject: [PATCH 2/2] http2: fix a resource leak in push_promise()
 ... detected by Coverity:
 Error: RESOURCE_LEAK (CWE-772):
 lib/http2.c:532: alloc_fn: Storage is returned from allocation function "duphandle".
 lib/http2.c:532: var_assign: Assigning: "newhandle" = storage returned from "duphandle(data)".
 lib/http2.c:552: noescape: Resource "newhandle" is not freed or pointed-to in "set_transfer_url".
 lib/http2.c:555: leaked_storage: Variable "newhandle" going out of scope leaks the storage it points to.
 Closes #6986
 Upstream-commit: 3a6058cb976981ec1db870f9657c73c9a1162822
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/http2.c | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/lib/http2.c b/lib/http2.c
 index d5ba89b..d0f69ea 100644
 --- a/lib/http2.c
 +++ b/lib/http2.c
@@ -581,6 +581,7 @@ static int push_promise(struct Curl_easy *data,
     rv = set_transfer_url(newhandle, &heads);
     if(rv) {
 +      (void)Curl_close(&newhandle);
       rv = CURL_PUSH_DENY;
       goto fail;
     }
 -- 
 2.30.2
--- a/SOURCES/0002-curl-7.61.1-tlsv1.0-man.patch
+++ b/SOURCES/0002-curl-7.61.1-tlsv1.0-man.patch
@ -0,0 +1,28 @@
 From c574e05b0035f0d78e6bf6040d3f80430112ab4f Mon Sep 17 00:00:00 2001
 From: Kamil Dudka <kdudka@redhat.com>
 Date: Fri, 7 Sep 2018 16:50:45 +0200
 Subject: [PATCH] docs/cmdline-opts: update the documentation of --tlsv1.0
 ... to reflect the changes in 6015cefb1b2cfde4b4850121c42405275e5e77d9
 Closes #2955
 Upstream-commit: 9ba22ce6b52751ed1e2abdd177b0a1d241819b4e
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 docs/cmdline-opts/tlsv1.0.d | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/docs/cmdline-opts/tlsv1.0.d b/docs/cmdline-opts/tlsv1.0.d
 index 8789025e0..54e259682 100644
 --- a/docs/cmdline-opts/tlsv1.0.d
 +++ b/docs/cmdline-opts/tlsv1.0.d
@@ -3,4 +3,4 @@ Help: Use TLSv1.0
 Protocols: TLS
 Added: 7.34.0
 ---
 -Forces curl to use TLS version 1.0 when connecting to a remote TLS server.
 +Forces curl to use TLS version 1.0 or later when connecting to a remote TLS server.
 -- 
 2.17.1
--- a/SOURCES/0003-curl-7.61.1-TLS-1.3-PHA.patch
+++ b/SOURCES/0003-curl-7.61.1-TLS-1.3-PHA.patch
@ -0,0 +1,46 @@
 From bb8ad3da3fb4ab3f6556daa1f67b259c12a3c7de Mon Sep 17 00:00:00 2001
 From: Christian Heimes <christian@python.org>
 Date: Fri, 21 Sep 2018 10:37:43 +0200
 Subject: [PATCH] OpenSSL: enable TLS 1.3 post-handshake auth
 OpenSSL 1.1.1 requires clients to opt-in for post-handshake
 authentication.
 Fixes: https://github.com/curl/curl/issues/3026
 Signed-off-by: Christian Heimes <christian@python.org>
 Closes https://github.com/curl/curl/pull/3027
 Upstream-commit: b939bc47b27cd57c6ebb852ad653933e4124b452
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/vtls/openssl.c | 6 ++++++
 1 file changed, 6 insertions(+)
 diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
 index a487f55..78970d1 100644
 --- a/lib/vtls/openssl.c
 +++ b/lib/vtls/openssl.c
@@ -178,6 +178,7 @@ static unsigned long OpenSSL_version_num(void)
      !defined(LIBRESSL_VERSION_NUMBER) &&       \
      !defined(OPENSSL_IS_BORINGSSL))
 #define HAVE_SSL_CTX_SET_CIPHERSUITES
 +#define HAVE_SSL_CTX_SET_POST_HANDSHAKE_AUTH
 #endif
 #if defined(LIBRESSL_VERSION_NUMBER)
@@ -2467,6 +2468,11 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
   }
 #endif
 +#ifdef HAVE_SSL_CTX_SET_POST_HANDSHAKE_AUTH
 +  /* OpenSSL 1.1.1 requires clients to opt-in for PHA */
 +  SSL_CTX_set_post_handshake_auth(BACKEND->ctx, 1);
 +#endif
 +
 #ifdef USE_TLS_SRP
   if(ssl_authtype == CURL_TLSAUTH_SRP) {
     char * const ssl_username = SSL_SET_OPTION(username);
 -- 
 2.17.1
--- a/SOURCES/0003-curl-7.76.1-CVE-2021-22901.patch
+++ b/SOURCES/0003-curl-7.76.1-CVE-2021-22901.patch
--- a/SOURCES/0004-curl-7.61.1-CVE-2018-16842.patch
+++ b/SOURCES/0004-curl-7.61.1-CVE-2018-16842.patch
@ -0,0 +1,81 @@
 From 27d6c92acdac671ddf8f77f72956b2181561f774 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Sun, 28 Oct 2018 01:33:23 +0200
 Subject: [PATCH 1/2] voutf: fix bad arethmetic when outputting warnings to
 stderr
 CVE-2018-16842
 Reported-by: Brian Carpenter
 Bug: https://curl.haxx.se/docs/CVE-2018-16842.html
 Upstream-commit: d530e92f59ae9bb2d47066c3c460b25d2ffeb211
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 src/tool_msgs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/tool_msgs.c b/src/tool_msgs.c
 index 9cce806..05bec39 100644
 --- a/src/tool_msgs.c
 +++ b/src/tool_msgs.c
@@ -67,7 +67,7 @@ static void voutf(struct GlobalConfig *config,
         (void)fwrite(ptr, cut + 1, 1, config->errors);
         fputs("\n", config->errors);
         ptr += cut + 1; /* skip the space too */
 -        len -= cut;
 +        len -= cut + 1;
       }
       else {
         fputs(ptr, config->errors);
 -- 
 2.17.2
 From 23f8c641b02e6c302d0e8cc5a5ee225a33b01f28 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Sun, 28 Oct 2018 10:43:57 +0100
 Subject: [PATCH 2/2] test2080: verify the fix for CVE-2018-16842
 Upstream-commit: 350306e4726b71b5b386fc30e3fecc039a807157
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/data/Makefile.inc |   4 ++--
 tests/data/test2080     | Bin 0 -> 20659 bytes
 2 files changed, 2 insertions(+), 2 deletions(-)
 create mode 100644 tests/data/test2080
 diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
 index e045748..aa5fff0 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
@@ -198,7 +198,7 @@ test2048 test2049 test2050 test2051 test2052 test2053 test2054 test2055 \
 test2056 test2057 test2058 test2059 test2060 test2061 test2062 test2063 \
 test2064 test2065 test2066 test2067 test2068 test2069 \
 \
 -test2070 test2071 test2072 test2073 \
 -test2074 test2075 \
 +test2070 test2071 test2072 test2073 test2074 test2075 \
 +test2080 \
 \
 test3000 test3001
 diff --git a/tests/data/test2080 b/tests/data/test2080
 new file mode 100644
 index 0000000000000000000000000000000000000000..47e376ecb5d7879c0a98e392bff48ccc52e9db0a
 GIT binary patch
 literal 20659
 zcmeI)Pj3@35QkyT{uI*`iBshYE(n>u@JB+F3kdG+t~asjwJY0gl}``eO+)FONU8ef
 zl6Ca+%<OZ|nCeRHZE>A4K8~q<UAgUD%0ubY=PwtZRG;GL*UIRJ-;Lfy)u}p_A1>dz
 zd{+G6l*#ToY+DU||F9%J1n*+KPxQ;7MapuoQ!&MMQSXmpqMh0_yS6g=;N;HNjilBk
 zY$c?)mULZxib{;$g~jw~nrs|8b@sJI)_QmS_4(WLrNld}2Y0LEO$e>m->_NA&o$n!
 z9^YDZ>cvMs2q1s}0tg_000PG)@a?$9VHyMwKmY**5I_I{1Q0m1z~!MEP#*yV5I_I{
 z1Q0*~0R#|0009ILKmY**4ldvh-hl=PAb<b@2q1s}0tg`Rgaqum{m<+P&C93=Ab<b@
 z2q1s}0tg_0z|jf3Ji3V(2mu5TK;StGoIK~3=iL!N0D=D{@VjlsoA=?(>-+Xw`j-8D
 zzg+g?Rt8(G*s;1Sb>n1S94H%G<kGn)tFlRTrA%AW*RoyP3pi(fe!mc3WU^sQd2)l4
 jB)+~1L0rx$OS-AbERTH}TH`mZ^*=|W_vMU!*i-li)g+9V
 literal 0
 HcmV?d00001
 -- 
 2.17.2
--- a/SOURCES/0004-curl-7.76.1-ldaps-segv.patch
+++ b/SOURCES/0004-curl-7.76.1-ldaps-segv.patch
@ -1,44 +0,0 @@
 From 39b68b3f82535d06e50443db4c191dbaa00df4eb Mon Sep 17 00:00:00 2001
 From: Patrick Monnerat <patrick@monnerat.net>
 Date: Fri, 23 Apr 2021 00:33:46 +0200
 Subject: [PATCH] vtls: reset ssl use flag upon negotiation failure
 Fixes the segfault in ldaps disconnect.
 Reported-by: Illarion Taev
 Fixes #6934
 Closes #6937
 Upstream-commit: a4554b2c5e7c5788c8198001598818599c60ff7d
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/vtls/vtls.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
 diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
 index 22cfb88..fa8a6fa 100644
 --- a/lib/vtls/vtls.c
 +++ b/lib/vtls/vtls.c
@@ -315,6 +315,8 @@ Curl_ssl_connect(struct Curl_easy *data, struct connectdata *conn,
   if(!result)
     Curl_pgrsTime(data, TIMER_APPCONNECT); /* SSL is connected */
 +  else
 +    conn->ssl[sockindex].use = FALSE;
   return result;
 }
@@ -338,7 +340,9 @@ Curl_ssl_connect_nonblocking(struct Curl_easy *data, struct connectdata *conn,
   /* mark this is being ssl requested from here on. */
   conn->ssl[sockindex].use = TRUE;
   result = Curl_ssl->connect_nonblocking(data, conn, sockindex, done);
 -  if(!result && *done)
 +  if(result)
 +    conn->ssl[sockindex].use = FALSE;
 +  else if(*done)
     Curl_pgrsTime(data, TIMER_APPCONNECT); /* SSL is connected */
   return result;
 }
 -- 
 2.31.1
--- a/SOURCES/0005-curl-7.61.1-CVE-2018-16840.patch
+++ b/SOURCES/0005-curl-7.61.1-CVE-2018-16840.patch
@ -0,0 +1,39 @@
 From 235f209a0e62edee654be441a50bb0c154edeaa5 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 18 Oct 2018 15:07:15 +0200
 Subject: [PATCH] Curl_close: clear data->multi_easy on free to avoid
 use-after-free
 Regression from b46cfbc068 (7.59.0)
 CVE-2018-16840
 Reported-by: Brian Carpenter (Geeknik Labs)
 Bug: https://curl.haxx.se/docs/CVE-2018-16840.html
 Upstream-commit: 81d135d67155c5295b1033679c606165d4e28f3f
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/url.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 diff --git a/lib/url.c b/lib/url.c
 index f159008..dcc1ecc 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -319,10 +319,12 @@ CURLcode Curl_close(struct Curl_easy *data)
        and detach this handle from there. */
     curl_multi_remove_handle(data->multi, data);
 -  if(data->multi_easy)
 +  if(data->multi_easy) {
     /* when curl_easy_perform() is used, it creates its own multi handle to
        use and this is the one */
     curl_multi_cleanup(data->multi_easy);
 +    data->multi_easy = NULL;
 +  }
   /* Destroy the timeout list that is held in the easy handle. It is
      /normally/ done by curl_multi_remove_handle() but this is "just in
 -- 
 2.17.2
--- a/SOURCES/0005-curl-7.76.1-CVE-2021-22924.patch
+++ b/SOURCES/0005-curl-7.76.1-CVE-2021-22924.patch
@ -1,279 +0,0 @@
 From 30c7b4dd01734b6ba20bfc7790b9fe8bc0500214 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Sat, 19 Jun 2021 00:42:28 +0200
 Subject: [PATCH] vtls: fix connection reuse checks for issuer cert and case
 sensitivity
 CVE-2021-22924
 Reported-by: Harry Sintonen
 Bug: https://curl.se/docs/CVE-2021-22924.html
 Upstream-commit: 5ea3145850ebff1dc2b13d17440300a01ca38161
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/url.c          | 10 ++++++----
 lib/urldata.h      |  4 ++--
 lib/vtls/gtls.c    | 10 +++++-----
 lib/vtls/nss.c     |  4 ++--
 lib/vtls/openssl.c | 18 +++++++++---------
 lib/vtls/vtls.c    | 26 +++++++++++++++++++++-----
 6 files changed, 45 insertions(+), 27 deletions(-)
 diff --git a/lib/url.c b/lib/url.c
 index 9f2c9f2..bdcb095 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -3723,6 +3723,8 @@ static CURLcode create_conn(struct Curl_easy *data,
   */
   data->set.ssl.primary.CApath = data->set.str[STRING_SSL_CAPATH];
   data->set.ssl.primary.CAfile = data->set.str[STRING_SSL_CAFILE];
 +  data->set.ssl.primary.issuercert = data->set.str[STRING_SSL_ISSUERCERT];
 +  data->set.ssl.primary.issuercert_blob = data->set.blobs[BLOB_SSL_ISSUERCERT];
   data->set.ssl.primary.random_file = data->set.str[STRING_SSL_RANDOM_FILE];
   data->set.ssl.primary.egdsocket = data->set.str[STRING_SSL_EGDSOCKET];
   data->set.ssl.primary.cipher_list =
@@ -3747,8 +3749,11 @@ static CURLcode create_conn(struct Curl_easy *data,
   data->set.proxy_ssl.primary.pinned_key =
     data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY];
   data->set.proxy_ssl.primary.cert_blob = data->set.blobs[BLOB_CERT_PROXY];
 +  data->set.proxy_ssl.primary.issuercert =
 +    data->set.str[STRING_SSL_ISSUERCERT_PROXY];
 +  data->set.proxy_ssl.primary.issuercert_blob =
 +    data->set.blobs[BLOB_SSL_ISSUERCERT_PROXY];
   data->set.proxy_ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE_PROXY];
 -  data->set.proxy_ssl.issuercert = data->set.str[STRING_SSL_ISSUERCERT_PROXY];
   data->set.proxy_ssl.cert_type = data->set.str[STRING_CERT_TYPE_PROXY];
   data->set.proxy_ssl.key = data->set.str[STRING_KEY_PROXY];
   data->set.proxy_ssl.key_type = data->set.str[STRING_KEY_TYPE_PROXY];
@@ -3757,7 +3762,6 @@ static CURLcode create_conn(struct Curl_easy *data,
   data->set.proxy_ssl.key_blob = data->set.blobs[BLOB_KEY_PROXY];
 #endif
   data->set.ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE];
 -  data->set.ssl.issuercert = data->set.str[STRING_SSL_ISSUERCERT];
   data->set.ssl.cert_type = data->set.str[STRING_CERT_TYPE];
   data->set.ssl.key = data->set.str[STRING_KEY];
   data->set.ssl.key_type = data->set.str[STRING_KEY_TYPE];
@@ -3771,9 +3775,7 @@ static CURLcode create_conn(struct Curl_easy *data,
   data->set.proxy_ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD_PROXY];
 #endif
 #endif
 -
   data->set.ssl.key_blob = data->set.blobs[BLOB_KEY];
 -  data->set.ssl.issuercert_blob = data->set.blobs[BLOB_SSL_ISSUERCERT];
   if(!Curl_clone_primary_ssl_config(&data->set.ssl.primary,
                                     &conn->ssl_config)) {
 diff --git a/lib/urldata.h b/lib/urldata.h
 index 2bb7d81..7cf63d0 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -246,6 +246,7 @@ struct ssl_primary_config {
   long version_max;      /* max supported version the client wants to use*/
   char *CApath;          /* certificate dir (doesn't work on windows) */
   char *CAfile;          /* certificate to verify peer against */
 +  char *issuercert;      /* optional issuer certificate filename */
   char *clientcert;
   char *random_file;     /* path to file containing "random" data */
   char *egdsocket;       /* path to file containing the EGD daemon socket */
@@ -253,6 +254,7 @@ struct ssl_primary_config {
   char *cipher_list13;   /* list of TLS 1.3 cipher suites to use */
   char *pinned_key;
   struct curl_blob *cert_blob;
 +  struct curl_blob *issuercert_blob;
   char *curves;          /* list of curves to use */
   BIT(verifypeer);       /* set TRUE if this is desired */
   BIT(verifyhost);       /* set TRUE if CN/SAN must match hostname */
@@ -264,8 +266,6 @@ struct ssl_config_data {
   struct ssl_primary_config primary;
   long certverifyresult; /* result from the certificate verification */
   char *CRLfile;   /* CRL to check certificate revocation */
 -  char *issuercert;/* optional issuer certificate filename */
 -  struct curl_blob *issuercert_blob;
   curl_ssl_ctx_callback fsslctx; /* function to initialize ssl ctx */
   void *fsslctxp;        /* parameter for call back */
   char *cert_type; /* format for certificate (default: PEM)*/
 diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
 index ea54fe3..ccc5ce8 100644
 --- a/lib/vtls/gtls.c
 +++ b/lib/vtls/gtls.c
@@ -849,7 +849,7 @@ gtls_connect_step3(struct Curl_easy *data,
   if(!chainp) {
     if(SSL_CONN_CONFIG(verifypeer) ||
        SSL_CONN_CONFIG(verifyhost) ||
 -       SSL_SET_OPTION(issuercert)) {
 +       SSL_CONN_CONFIG(issuercert)) {
 #ifdef HAVE_GNUTLS_SRP
       if(SSL_SET_OPTION(authtype) == CURL_TLSAUTH_SRP
          && SSL_SET_OPTION(username) != NULL
@@ -1033,21 +1033,21 @@ gtls_connect_step3(struct Curl_easy *data,
        gnutls_x509_crt_t format */
     gnutls_x509_crt_import(x509_cert, chainp, GNUTLS_X509_FMT_DER);
 -  if(SSL_SET_OPTION(issuercert)) {
 +  if(SSL_CONN_CONFIG(issuercert)) {
     gnutls_x509_crt_init(&x509_issuer);
 -    issuerp = load_file(SSL_SET_OPTION(issuercert));
 +    issuerp = load_file(SSL_CONN_CONFIG(issuercert));
     gnutls_x509_crt_import(x509_issuer, &issuerp, GNUTLS_X509_FMT_PEM);
     rc = gnutls_x509_crt_check_issuer(x509_cert, x509_issuer);
     gnutls_x509_crt_deinit(x509_issuer);
     unload_file(issuerp);
     if(rc <= 0) {
       failf(data, "server certificate issuer check failed (IssuerCert: %s)",
 -            SSL_SET_OPTION(issuercert)?SSL_SET_OPTION(issuercert):"none");
 +            SSL_CONN_CONFIG(issuercert)?SSL_CONN_CONFIG(issuercert):"none");
       gnutls_x509_crt_deinit(x509_cert);
       return CURLE_SSL_ISSUER_ERROR;
     }
     infof(data, "\t server certificate issuer check OK (Issuer Cert: %s)\n",
 -          SSL_SET_OPTION(issuercert)?SSL_SET_OPTION(issuercert):"none");
 +          SSL_CONN_CONFIG(issuercert)?SSL_CONN_CONFIG(issuercert):"none");
   }
   size = sizeof(certname);
 diff --git a/lib/vtls/nss.c b/lib/vtls/nss.c
 index ae3945c..b0b1e8c 100644
 --- a/lib/vtls/nss.c
 +++ b/lib/vtls/nss.c
@@ -2156,9 +2156,9 @@ static CURLcode nss_do_connect(struct Curl_easy *data,
   if(result)
     goto error;
 -  if(SSL_SET_OPTION(issuercert)) {
 +  if(SSL_CONN_CONFIG(issuercert)) {
     SECStatus ret = SECFailure;
 -    char *nickname = dup_nickname(data, SSL_SET_OPTION(issuercert));
 +    char *nickname = dup_nickname(data, SSL_CONN_CONFIG(issuercert));
     if(nickname) {
       /* we support only nicknames in case of issuercert for now */
       ret = check_issuer_cert(backend->handle, nickname);
 diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
 index 2404393..be7b811 100644
 --- a/lib/vtls/openssl.c
 +++ b/lib/vtls/openssl.c
@@ -3872,10 +3872,10 @@ static CURLcode servercert(struct Curl_easy *data,
        deallocating the certificate. */
     /* e.g. match issuer name with provided issuer certificate */
 -    if(SSL_SET_OPTION(issuercert) || SSL_SET_OPTION(issuercert_blob)) {
 -      if(SSL_SET_OPTION(issuercert_blob))
 -        fp = BIO_new_mem_buf(SSL_SET_OPTION(issuercert_blob)->data,
 -                             (int)SSL_SET_OPTION(issuercert_blob)->len);
 +    if(SSL_CONN_CONFIG(issuercert) || SSL_CONN_CONFIG(issuercert_blob)) {
 +      if(SSL_CONN_CONFIG(issuercert_blob))
 +        fp = BIO_new_mem_buf(SSL_CONN_CONFIG(issuercert_blob)->data,
 +                             (int)SSL_CONN_CONFIG(issuercert_blob)->len);
       else {
         fp = BIO_new(BIO_s_file());
         if(fp == NULL) {
@@ -3889,10 +3889,10 @@ static CURLcode servercert(struct Curl_easy *data,
           return CURLE_OUT_OF_MEMORY;
         }
 -        if(BIO_read_filename(fp, SSL_SET_OPTION(issuercert)) <= 0) {
 +        if(BIO_read_filename(fp, SSL_CONN_CONFIG(issuercert)) <= 0) {
           if(strict)
             failf(data, "SSL: Unable to open issuer cert (%s)",
 -                  SSL_SET_OPTION(issuercert));
 +                  SSL_CONN_CONFIG(issuercert));
           BIO_free(fp);
           X509_free(backend->server_cert);
           backend->server_cert = NULL;
@@ -3904,7 +3904,7 @@ static CURLcode servercert(struct Curl_easy *data,
       if(!issuer) {
         if(strict)
           failf(data, "SSL: Unable to read issuer cert (%s)",
 -                SSL_SET_OPTION(issuercert));
 +                SSL_CONN_CONFIG(issuercert));
         BIO_free(fp);
         X509_free(issuer);
         X509_free(backend->server_cert);
@@ -3915,7 +3915,7 @@ static CURLcode servercert(struct Curl_easy *data,
       if(X509_check_issued(issuer, backend->server_cert) != X509_V_OK) {
         if(strict)
           failf(data, "SSL: Certificate issuer check failed (%s)",
 -                SSL_SET_OPTION(issuercert));
 +                SSL_CONN_CONFIG(issuercert));
         BIO_free(fp);
         X509_free(issuer);
         X509_free(backend->server_cert);
@@ -3924,7 +3924,7 @@ static CURLcode servercert(struct Curl_easy *data,
       }
       infof(data, " SSL certificate issuer check ok (%s)\n",
 -            SSL_SET_OPTION(issuercert));
 +            SSL_CONN_CONFIG(issuercert));
       BIO_free(fp);
       X509_free(issuer);
     }
 diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
 index fa8a6fa..1aa6fc8 100644
 --- a/lib/vtls/vtls.c
 +++ b/lib/vtls/vtls.c
@@ -125,6 +125,16 @@ static bool blobcmp(struct curl_blob *first, struct curl_blob *second)
   return !memcmp(first->data, second->data, first->len); /* same data */
 }
 +static bool safecmp(char *a, char *b)
 +{
 +  if(a && b)
 +    return !strcmp(a, b);
 +  else if(!a && !b)
 +    return TRUE; /* match */
 +  return FALSE; /* no match */
 +}
 +
 +
 bool
 Curl_ssl_config_matches(struct ssl_primary_config *data,
                         struct ssl_primary_config *needle)
@@ -135,11 +145,13 @@ Curl_ssl_config_matches(struct ssl_primary_config *data,
      (data->verifyhost == needle->verifyhost) &&
      (data->verifystatus == needle->verifystatus) &&
      blobcmp(data->cert_blob, needle->cert_blob) &&
 -     Curl_safe_strcasecompare(data->CApath, needle->CApath) &&
 -     Curl_safe_strcasecompare(data->CAfile, needle->CAfile) &&
 -     Curl_safe_strcasecompare(data->clientcert, needle->clientcert) &&
 -     Curl_safe_strcasecompare(data->random_file, needle->random_file) &&
 -     Curl_safe_strcasecompare(data->egdsocket, needle->egdsocket) &&
 +     blobcmp(data->issuercert_blob, needle->issuercert_blob) &&
 +     safecmp(data->CApath, needle->CApath) &&
 +     safecmp(data->CAfile, needle->CAfile) &&
 +     safecmp(data->issuercert, needle->issuercert) &&
 +     safecmp(data->clientcert, needle->clientcert) &&
 +     safecmp(data->random_file, needle->random_file) &&
 +     safecmp(data->egdsocket, needle->egdsocket) &&
      Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) &&
      Curl_safe_strcasecompare(data->cipher_list13, needle->cipher_list13) &&
      Curl_safe_strcasecompare(data->curves, needle->curves) &&
@@ -161,8 +173,10 @@ Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
   dest->sessionid = source->sessionid;
   CLONE_BLOB(cert_blob);
 +  CLONE_BLOB(issuercert_blob);
   CLONE_STRING(CApath);
   CLONE_STRING(CAfile);
 +  CLONE_STRING(issuercert);
   CLONE_STRING(clientcert);
   CLONE_STRING(random_file);
   CLONE_STRING(egdsocket);
@@ -178,6 +192,7 @@ void Curl_free_primary_ssl_config(struct ssl_primary_config *sslc)
 {
   Curl_safefree(sslc->CApath);
   Curl_safefree(sslc->CAfile);
 +  Curl_safefree(sslc->issuercert);
   Curl_safefree(sslc->clientcert);
   Curl_safefree(sslc->random_file);
   Curl_safefree(sslc->egdsocket);
@@ -185,6 +200,7 @@ void Curl_free_primary_ssl_config(struct ssl_primary_config *sslc)
   Curl_safefree(sslc->cipher_list13);
   Curl_safefree(sslc->pinned_key);
   Curl_safefree(sslc->cert_blob);
 +  Curl_safefree(sslc->issuercert_blob);
   Curl_safefree(sslc->curves);
 }
 -- 
 2.31.1
--- a/SOURCES/0006-curl-7.61.1-CVE-2018-16839.patch
+++ b/SOURCES/0006-curl-7.61.1-CVE-2018-16839.patch
@ -0,0 +1,31 @@
 From ad9943254ded9a983af7d581e8a1f3317e8a8781 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Fri, 28 Sep 2018 16:08:16 +0200
 Subject: [PATCH] Curl_auth_create_plain_message: fix too-large-input-check
 CVE-2018-16839
 Reported-by: Harry Sintonen
 Bug: https://curl.haxx.se/docs/CVE-2018-16839.html
 Upstream-commit: f3a24d7916b9173c69a3e0ee790102993833d6c5
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/vauth/cleartext.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/lib/vauth/cleartext.c b/lib/vauth/cleartext.c
 index 5d61ce6..1367143 100644
 --- a/lib/vauth/cleartext.c
 +++ b/lib/vauth/cleartext.c
@@ -74,7 +74,7 @@ CURLcode Curl_auth_create_plain_message(struct Curl_easy *data,
   plen = strlen(passwdp);
   /* Compute binary message length. Check for overflows. */
 -  if((ulen > SIZE_T_MAX/2) || (plen > (SIZE_T_MAX/2 - 2)))
 +  if((ulen > SIZE_T_MAX/4) || (plen > (SIZE_T_MAX/2 - 2)))
     return CURLE_OUT_OF_MEMORY;
   plainlen = 2 * ulen + plen + 2;
 -- 
 2.17.2
--- a/SOURCES/0007-curl-7.63.0-JO-preserve-local-file.patch
+++ b/SOURCES/0007-curl-7.63.0-JO-preserve-local-file.patch
@ -0,0 +1,116 @@
 From ff74657fb645e7175971128a171ef7d5ece40d77 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 17 Dec 2018 12:51:51 +0100
 Subject: [PATCH] curl -J: do not append to the destination file
 Reported-by: Kamil Dudka
 Fixes #3380
 Closes #3381
 Upstream-commit: 4849267197682e69cfa056c2bd7a44acd123a917
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 src/tool_cb_hdr.c  | 6 +++---
 src/tool_cb_wrt.c  | 9 ++++-----
 src/tool_cb_wrt.h  | 2 +-
 src/tool_operate.c | 2 +-
 4 files changed, 9 insertions(+), 10 deletions(-)
 diff --git a/src/tool_cb_hdr.c b/src/tool_cb_hdr.c
 index 84b0d9c..3844904 100644
 --- a/src/tool_cb_hdr.c
 +++ b/src/tool_cb_hdr.c
@@ -148,12 +148,12 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
         outs->filename = filename;
         outs->alloc_filename = TRUE;
         hdrcbdata->honor_cd_filename = FALSE; /* done now! */
 -        if(!tool_create_output_file(outs, TRUE))
 +        if(!tool_create_output_file(outs))
           return failure;
       }
       break;
     }
 -    if(!outs->stream && !tool_create_output_file(outs, FALSE))
 +    if(!outs->stream && !tool_create_output_file(outs))
       return failure;
   }
@@ -162,7 +162,7 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
     /* bold headers only happen for HTTP(S) and RTSP */
     char *value = NULL;
 -    if(!outs->stream && !tool_create_output_file(outs, FALSE))
 +    if(!outs->stream && !tool_create_output_file(outs))
       return failure;
     if(hdrcbdata->global->isatty && hdrcbdata->global->styled_output)
 diff --git a/src/tool_cb_wrt.c b/src/tool_cb_wrt.c
 index 2cb5e1b..195d6e7 100644
 --- a/src/tool_cb_wrt.c
 +++ b/src/tool_cb_wrt.c
@@ -32,8 +32,7 @@
 #include "memdebug.h" /* keep this as LAST include */
 /* create a local file for writing, return TRUE on success */
 -bool tool_create_output_file(struct OutStruct *outs,
 -                             bool append)
 +bool tool_create_output_file(struct OutStruct *outs)
 {
   struct GlobalConfig *global = outs->config->global;
   FILE *file;
@@ -43,7 +42,7 @@ bool tool_create_output_file(struct OutStruct *outs,
     return FALSE;
   }
 -  if(outs->is_cd_filename && !append) {
 +  if(outs->is_cd_filename) {
     /* don't overwrite existing files */
     file = fopen(outs->filename, "rb");
     if(file) {
@@ -55,7 +54,7 @@ bool tool_create_output_file(struct OutStruct *outs,
   }
   /* open file for writing */
 -  file = fopen(outs->filename, append?"ab":"wb");
 +  file = fopen(outs->filename, "wb");
   if(!file) {
     warnf(global, "Failed to create the file %s: %s\n", outs->filename,
           strerror(errno));
@@ -142,7 +141,7 @@ size_t tool_write_cb(char *buffer, size_t sz, size_t nmemb, void *userdata)
   }
 #endif
 -  if(!outs->stream && !tool_create_output_file(outs, FALSE))
 +  if(!outs->stream && !tool_create_output_file(outs))
     return failure;
   if(is_tty && (outs->bytes < 2000) && !config->terminal_binary_ok) {
 diff --git a/src/tool_cb_wrt.h b/src/tool_cb_wrt.h
 index 51e002b..188d3ea 100644
 --- a/src/tool_cb_wrt.h
 +++ b/src/tool_cb_wrt.h
@@ -30,7 +30,7 @@
 size_t tool_write_cb(char *buffer, size_t sz, size_t nmemb, void *userdata);
 /* create a local file for writing, return TRUE on success */
 -bool tool_create_output_file(struct OutStruct *outs, bool append);
 +bool tool_create_output_file(struct OutStruct *outs);
 #endif /* HEADER_CURL_TOOL_CB_WRT_H */
 diff --git a/src/tool_operate.c b/src/tool_operate.c
 index e53a9d8..429e9cf 100644
 --- a/src/tool_operate.c
 +++ b/src/tool_operate.c
@@ -1581,7 +1581,7 @@ static CURLcode operate_do(struct GlobalConfig *global,
             /* do not create (or even overwrite) the file in case we get no
                data because of unmet condition */
             curl_easy_getinfo(curl, CURLINFO_CONDITION_UNMET, &cond_unmet);
 -            if(!cond_unmet && !tool_create_output_file(&outs, FALSE))
 +            if(!cond_unmet && !tool_create_output_file(&outs))
               result = CURLE_WRITE_ERROR;
           }
 -- 
 2.17.2
--- a/SOURCES/0007-curl-7.76.1-CVE-2021-22945.patch
+++ b/SOURCES/0007-curl-7.76.1-CVE-2021-22945.patch
@ -1,33 +0,0 @@
 From bb7619897e53ed424e0712ca5a4c93d5fae99715 Mon Sep 17 00:00:00 2001
 From: z2_ on hackerone <>
 Date: Tue, 24 Aug 2021 09:50:33 +0200
 Subject: [PATCH] mqtt: clear the leftovers pointer when sending succeeds
 CVE-2021-22945
 Bug: https://curl.se/docs/CVE-2021-22945.html
 Upstream-commit: 43157490a5054bd24256fe12876931e8abc9df49
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/mqtt.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/lib/mqtt.c b/lib/mqtt.c
 index d88fa73..f3fc045 100644
 --- a/lib/mqtt.c
 +++ b/lib/mqtt.c
@@ -128,6 +128,10 @@ static CURLcode mqtt_send(struct Curl_easy *data,
     mq->sendleftovers = sendleftovers;
     mq->nsend = nsend;
   }
 +  else {
 +    mq->sendleftovers = NULL;
 +    mq->nsend = 0;
 +  }
   return result;
 }
 -- 
 2.31.1
--- a/SOURCES/0008-curl-7.61.1-CVE-2018-20483.patch
+++ b/SOURCES/0008-curl-7.61.1-CVE-2018-20483.patch
--- a/SOURCES/0009-curl-7.61.1-CVE-2018-16890.patch
+++ b/SOURCES/0009-curl-7.61.1-CVE-2018-16890.patch
@ -0,0 +1,36 @@
 From 81c0e81531623251a0e78f7779c049f530abe733 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Wed, 2 Jan 2019 20:33:08 +0100
 Subject: [PATCH] NTLM: fix size check condition for type2 received data
 Bug: https://curl.haxx.se/docs/CVE-2018-16890.html
 Reported-by: Wenxiang Qian
 CVE-2018-16890
 Upstream-commit: b780b30d1377adb10bbe774835f49e9b237fb9bb
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/vauth/ntlm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
 diff --git a/lib/vauth/ntlm.c b/lib/vauth/ntlm.c
 index cdb8d8f..b614cda 100644
 --- a/lib/vauth/ntlm.c
 +++ b/lib/vauth/ntlm.c
@@ -182,10 +182,11 @@ static CURLcode ntlm_decode_type2_target(struct Curl_easy *data,
     target_info_len = Curl_read16_le(&buffer[40]);
     target_info_offset = Curl_read32_le(&buffer[44]);
     if(target_info_len > 0) {
 -      if(((target_info_offset + target_info_len) > size) ||
 +      if((target_info_offset >= size) ||
 +         ((target_info_offset + target_info_len) > size) ||
          (target_info_offset < 48)) {
         infof(data, "NTLM handshake failure (bad type-2 message). "
 -                    "Target Info Offset Len is set incorrect by the peer\n");
 +              "Target Info Offset Len is set incorrect by the peer\n");
         return CURLE_BAD_CONTENT_ENCODING;
       }
 -- 
 2.17.2
--- a/SOURCES/0010-curl-7.61.1-CVE-2019-3822.patch
+++ b/SOURCES/0010-curl-7.61.1-CVE-2019-3822.patch
@ -0,0 +1,41 @@
 From ab22e3a00f04b458039c21111cfa448051e5777d Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 3 Jan 2019 12:59:28 +0100
 Subject: [PATCH] ntlm: fix *_type3_message size check to avoid buffer overflow
 Bug: https://curl.haxx.se/docs/CVE-2019-3822.html
 Reported-by: Wenxiang Qian
 CVE-2019-3822
 Upstream-commit: 50c9484278c63b958655a717844f0721263939cc
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/vauth/ntlm.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)
 diff --git a/lib/vauth/ntlm.c b/lib/vauth/ntlm.c
 index b614cda..a3a55d9 100644
 --- a/lib/vauth/ntlm.c
 +++ b/lib/vauth/ntlm.c
@@ -777,11 +777,14 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
   });
 #ifdef USE_NTRESPONSES
 -  if(size < (NTLM_BUFSIZE - ntresplen)) {
 -    DEBUGASSERT(size == (size_t)ntrespoff);
 -    memcpy(&ntlmbuf[size], ptr_ntresp, ntresplen);
 -    size += ntresplen;
 +  /* ntresplen + size should not be risking an integer overflow here */
 +  if(ntresplen + size > sizeof(ntlmbuf)) {
 +    failf(data, "incoming NTLM message too big");
 +    return CURLE_OUT_OF_MEMORY;
   }
 +  DEBUGASSERT(size == (size_t)ntrespoff);
 +  memcpy(&ntlmbuf[size], ptr_ntresp, ntresplen);
 +  size += ntresplen;
   DEBUG_OUT({
     fprintf(stderr, "\n   ntresp=");
 -- 
 2.17.2
--- a/SOURCES/0010-curl-7.76.1-CVE-2022-22576.patch
+++ b/SOURCES/0010-curl-7.76.1-CVE-2022-22576.patch
@ -1,148 +0,0 @@
 From 85d1103c2fc0c9b1bdfae470dbafd45758e1c2f0 Mon Sep 17 00:00:00 2001
 From: Patrick Monnerat <patrick@monnerat.net>
 Date: Mon, 25 Apr 2022 11:44:05 +0200
 Subject: [PATCH] url: check sasl additional parameters for connection reuse.
 Also move static function safecmp() as non-static Curl_safecmp() since
 its purpose is needed at several places.
 Bug: https://curl.se/docs/CVE-2022-22576.html
 CVE-2022-22576
 Closes #8746
 Upstream-commit: 852aa5ad351ea53e5f01d2f44b5b4370c2bf5425
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/strcase.c   | 10 ++++++++++
 lib/strcase.h   |  2 ++
 lib/url.c       | 13 ++++++++++++-
 lib/urldata.h   |  1 +
 lib/vtls/vtls.c | 21 ++++++---------------
 5 files changed, 31 insertions(+), 16 deletions(-)
 diff --git a/lib/strcase.c b/lib/strcase.c
 index dd46ca1..692a3f1 100644
 --- a/lib/strcase.c
 +++ b/lib/strcase.c
@@ -251,6 +251,16 @@ void Curl_strntolower(char *dest, const char *src, size_t n)
   } while(*src++ && --n);
 }
 +/* Compare case-sensitive NUL-terminated strings, taking care of possible
 + * null pointers. Return true if arguments match.
 + */
 +bool Curl_safecmp(char *a, char *b)
 +{
 +  if(a && b)
 +    return !strcmp(a, b);
 +  return !a && !b;
 +}
 +
 /* --- public functions --- */
 int curl_strequal(const char *first, const char *second)
 diff --git a/lib/strcase.h b/lib/strcase.h
 index b628656..382b80a 100644
 --- a/lib/strcase.h
 +++ b/lib/strcase.h
@@ -48,4 +48,6 @@ char Curl_raw_toupper(char in);
 void Curl_strntoupper(char *dest, const char *src, size_t n);
 void Curl_strntolower(char *dest, const char *src, size_t n);
 +bool Curl_safecmp(char *a, char *b);
 +
 #endif /* HEADER_CURL_STRCASE_H */
 diff --git a/lib/url.c b/lib/url.c
 index adef2cd..94e3406 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -768,6 +768,7 @@ static void conn_free(struct connectdata *conn)
   Curl_safefree(conn->passwd);
   Curl_safefree(conn->sasl_authzid);
   Curl_safefree(conn->options);
 +  Curl_safefree(conn->oauth_bearer);
   Curl_dyn_free(&conn->trailer);
   Curl_safefree(conn->host.rawalloc); /* host name buffer */
   Curl_safefree(conn->conn_to_host.rawalloc); /* host name buffer */
@@ -1310,7 +1311,9 @@ ConnectionExists(struct Curl_easy *data,
         /* This protocol requires credentials per connection,
            so verify that we're using the same name and password as well */
         if(strcmp(needle->user, check->user) ||
 -           strcmp(needle->passwd, check->passwd)) {
 +           strcmp(needle->passwd, check->passwd) ||
 +           !Curl_safecmp(needle->sasl_authzid, check->sasl_authzid) ||
 +           !Curl_safecmp(needle->oauth_bearer, check->oauth_bearer)) {
           /* one of them was different */
           continue;
         }
@@ -3554,6 +3557,14 @@ static CURLcode create_conn(struct Curl_easy *data,
     }
   }
 +  if(data->set.str[STRING_BEARER]) {
 +    conn->oauth_bearer = strdup(data->set.str[STRING_BEARER]);
 +    if(!conn->oauth_bearer) {
 +      result = CURLE_OUT_OF_MEMORY;
 +      goto out;
 +    }
 +  }
 +
 #ifdef USE_UNIX_SOCKETS
   if(data->set.str[STRING_UNIX_SOCKET_PATH]) {
     conn->unix_domain_socket = strdup(data->set.str[STRING_UNIX_SOCKET_PATH]);
 diff --git a/lib/urldata.h b/lib/urldata.h
 index cc8a600..03da59a 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -991,6 +991,7 @@ struct connectdata {
   char *passwd;  /* password string, allocated */
   char *options; /* options string, allocated */
   char *sasl_authzid;     /* authorisation identity string, allocated */
 +  char *oauth_bearer; /* OAUTH2 bearer, allocated */
   unsigned char httpversion; /* the HTTP version*10 reported by the server */
   struct curltime now;     /* "current" time */
   struct curltime created; /* creation time */
 diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
 index 03b85ba..a40ac06 100644
 --- a/lib/vtls/vtls.c
 +++ b/lib/vtls/vtls.c
@@ -125,15 +125,6 @@ static bool blobcmp(struct curl_blob *first, struct curl_blob *second)
   return !memcmp(first->data, second->data, first->len); /* same data */
 }
 -static bool safecmp(char *a, char *b)
 -{
 -  if(a && b)
 -    return !strcmp(a, b);
 -  else if(!a && !b)
 -    return TRUE; /* match */
 -  return FALSE; /* no match */
 -}
 -
 bool
 Curl_ssl_config_matches(struct ssl_primary_config *data,
@@ -146,12 +137,12 @@ Curl_ssl_config_matches(struct ssl_primary_config *data,
      (data->verifystatus == needle->verifystatus) &&
      blobcmp(data->cert_blob, needle->cert_blob) &&
      blobcmp(data->issuercert_blob, needle->issuercert_blob) &&
 -     safecmp(data->CApath, needle->CApath) &&
 -     safecmp(data->CAfile, needle->CAfile) &&
 -     safecmp(data->issuercert, needle->issuercert) &&
 -     safecmp(data->clientcert, needle->clientcert) &&
 -     safecmp(data->random_file, needle->random_file) &&
 -     safecmp(data->egdsocket, needle->egdsocket) &&
 +     Curl_safecmp(data->CApath, needle->CApath) &&
 +     Curl_safecmp(data->CAfile, needle->CAfile) &&
 +     Curl_safecmp(data->issuercert, needle->issuercert) &&
 +     Curl_safecmp(data->clientcert, needle->clientcert) &&
 +     Curl_safecmp(data->random_file, needle->random_file) &&
 +     Curl_safecmp(data->egdsocket, needle->egdsocket) &&
      Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) &&
      Curl_safe_strcasecompare(data->cipher_list13, needle->cipher_list13) &&
      Curl_safe_strcasecompare(data->curves, needle->curves) &&
 -- 
 2.34.1
--- a/SOURCES/0011-curl-7.61.1-CVE-2019-3823.patch
+++ b/SOURCES/0011-curl-7.61.1-CVE-2019-3823.patch
@ -0,0 +1,50 @@
 From d26f1025d0a0a6c602d758a2e0917759492473e9 Mon Sep 17 00:00:00 2001
 From: Daniel Gustafsson <daniel@yesql.se>
 Date: Sat, 19 Jan 2019 00:42:47 +0100
 Subject: [PATCH] smtp: avoid risk of buffer overflow in strtol
 If the incoming len 5, but the buffer does not have a termination
 after 5 bytes, the strtol() call may keep reading through the line
 buffer until is exceeds its boundary. Fix by ensuring that we are
 using a bounded read with a temporary buffer on the stack.
 Bug: https://curl.haxx.se/docs/CVE-2019-3823.html
 Reported-by: Brian Carpenter (Geeknik Labs)
 CVE-2019-3823
 Upstream-commit: 39df4073e5413fcdbb5a38da0c1ce6f1c0ceb484
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/smtp.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)
 diff --git a/lib/smtp.c b/lib/smtp.c
 index ecf10a4..1b9f92d 100644
 --- a/lib/smtp.c
 +++ b/lib/smtp.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
 - * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
 + * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -207,8 +207,12 @@ static bool smtp_endofresp(struct connectdata *conn, char *line, size_t len,
      Section 4. Examples of RFC-4954 but some e-mail servers ignore this and
      only send the response code instead as per Section 4.2. */
   if(line[3] == ' ' || len == 5) {
 +    char tmpline[6];
 +
     result = TRUE;
 -    *resp = curlx_sltosi(strtol(line, NULL, 10));
 +    memset(tmpline, '\0', sizeof(tmpline));
 +    memcpy(tmpline, line, (len == 5 ? 5 : 3));
 +    *resp = curlx_sltosi(strtol(tmpline, NULL, 10));
     /* Make sure real server never sends internal value */
     if(*resp == 1)
 -- 
 2.17.2
--- a/SOURCES/0011-curl-7.76.1-CVE-2022-27775.patch
+++ b/SOURCES/0011-curl-7.76.1-CVE-2022-27775.patch
@ -1,40 +0,0 @@
 From 187d0795030ccb4f410eb6089e265ac3571e56dd Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 25 Apr 2022 11:48:00 +0200
 Subject: [PATCH] conncache: include the zone id in the "bundle" hashkey
 Make connections to two separate IPv6 zone ids create separate
 connections.
 Reported-by: Harry Sintonen
 Bug: https://curl.se/docs/CVE-2022-27775.html
 Closes #8747
 Upstream-commit: 058f98dc3fe595f21dc26a5b9b1699e519ba5705
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/conncache.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)
 diff --git a/lib/conncache.c b/lib/conncache.c
 index cd5756a..9b9f683 100644
 --- a/lib/conncache.c
 +++ b/lib/conncache.c
@@ -159,8 +159,12 @@ static void hashkey(struct connectdata *conn, char *buf,
     /* report back which name we used */
     *hostp = hostname;
 -  /* put the number first so that the hostname gets cut off if too long */
 -  msnprintf(buf, len, "%ld%s", port, hostname);
 +  /* put the numbers first so that the hostname gets cut off if too long */
 +#ifdef ENABLE_IPV6
 +  msnprintf(buf, len, "%u/%ld/%s", conn->scope_id, port, hostname);
 +#else
 +  msnprintf(buf, len, "%ld/%s", port, hostname);
 +#endif
 }
 /* Returns number of connections currently held in the connection cache.
 -- 
 2.34.1
--- a/SOURCES/0012-curl-7.76.1-CVE-2022-27776.patch
+++ b/SOURCES/0012-curl-7.76.1-CVE-2022-27776.patch
@ -1,243 +0,0 @@
 From 2be87227d4b4024c91ff6c856520cac9c9619555 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 25 Apr 2022 13:05:40 +0200
 Subject: [PATCH 1/2] http: avoid auth/cookie on redirects same host diff port
 CVE-2022-27776
 Reported-by: Harry Sintonen
 Bug: https://curl.se/docs/CVE-2022-27776.html
 Closes #8749
 Upstream-commit: 6e659993952aa5f90f48864be84a1bbb047fc258
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/http.c    | 33 +++++++++++++++++++++------------
 lib/urldata.h | 16 +++++++++-------
 2 files changed, 30 insertions(+), 19 deletions(-)
 diff --git a/lib/http.c b/lib/http.c
 index 799d4fb..0791dcf 100644
 --- a/lib/http.c
 +++ b/lib/http.c
@@ -775,6 +775,21 @@ output_auth_headers(struct Curl_easy *data,
   return CURLE_OK;
 }
 +/*
 + * allow_auth_to_host() tells if autentication, cookies or other "sensitive
 + * data" can (still) be sent to this host.
 + */
 +static bool allow_auth_to_host(struct Curl_easy *data)
 +{
 +  struct connectdata *conn = data->conn;
 +  return (!data->state.this_is_a_follow ||
 +          data->set.allow_auth_to_other_hosts ||
 +          (data->state.first_host &&
 +           strcasecompare(data->state.first_host, conn->host.name) &&
 +           (data->state.first_remote_port == conn->remote_port) &&
 +           (data->state.first_remote_protocol == conn->handler->protocol)));
 +}
 +
 /**
  * Curl_http_output_auth() setups the authentication headers for the
  * host/proxy and the correct authentication
@@ -847,15 +862,11 @@ Curl_http_output_auth(struct Curl_easy *data,
        with it */
     authproxy->done = TRUE;
 -  /* To prevent the user+password to get sent to other than the original
 -     host due to a location-follow, we do some weirdo checks here */
 -  if(!data->state.this_is_a_follow ||
 -     conn->bits.netrc ||
 -     !data->state.first_host ||
 -     data->set.allow_auth_to_other_hosts ||
 -     strcasecompare(data->state.first_host, conn->host.name)) {
 +  /* To prevent the user+password to get sent to other than the original host
 +     due to a location-follow */
 +  if(allow_auth_to_host(data)
 +     || conn->bits.netrc)
     result = output_auth_headers(data, conn, authhost, request, path, FALSE);
 -  }
   else
     authhost->done = TRUE;
@@ -1906,10 +1917,7 @@ CURLcode Curl_add_custom_headers(struct Curl_easy *data,
                    checkprefix("Cookie:", compare)) &&
                   /* be careful of sending this potentially sensitive header to
                      other hosts */
 -                  (data->state.this_is_a_follow &&
 -                   data->state.first_host &&
 -                   !data->set.allow_auth_to_other_hosts &&
 -                   !strcasecompare(data->state.first_host, conn->host.name)))
 +                  !allow_auth_to_host(data))
             ;
           else {
 #ifdef USE_HYPER
@@ -2081,6 +2089,7 @@ CURLcode Curl_http_host(struct Curl_easy *data, struct connectdata *conn)
       return CURLE_OUT_OF_MEMORY;
     data->state.first_remote_port = conn->remote_port;
 +    data->state.first_remote_protocol = conn->handler->protocol;
   }
   Curl_safefree(data->state.aptr.host);
 diff --git a/lib/urldata.h b/lib/urldata.h
 index 03da59a..f92052a 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -1336,14 +1336,16 @@ struct UrlState {
   char *ulbuf; /* allocated upload buffer or NULL */
   curl_off_t current_speed;  /* the ProgressShow() function sets this,
                                 bytes / second */
 -  char *first_host; /* host name of the first (not followed) request.
 -                       if set, this should be the host name that we will
 -                       sent authorization to, no else. Used to make Location:
 -                       following not keep sending user+password... This is
 -                       strdup() data.
 -                    */
 +
 +  /* host name, port number and protocol of the first (not followed) request.
 +     if set, this should be the host name that we will sent authorization to,
 +     no else. Used to make Location: following not keep sending user+password.
 +     This is strdup()ed data. */
 +  char *first_host;
 +  int first_remote_port;
 +  unsigned int first_remote_protocol;
 +
   int retrycount; /* number of retries on a new connection */
 -  int first_remote_port; /* remote port of the first (not followed) request */
   struct Curl_ssl_session *session; /* array of 'max_ssl_sessions' size */
   long sessionage;                  /* number of the most recent session */
   struct tempbuf tempwrite[3]; /* BOTH, HEADER, BODY */
 -- 
 2.34.1
 From c0d12f1634785596746e5d461319dcb95b5b6ae8 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 25 Apr 2022 13:05:47 +0200
 Subject: [PATCH 2/2] test898: verify the fix for CVE-2022-27776
 Do not pass on Authorization headers on redirects to another port
 Upstream-commit: afe752e0504ab60bf63787ede0b992cbe1065f78
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/data/Makefile.inc |  2 +-
 tests/data/test898      | 90 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 91 insertions(+), 1 deletion(-)
 create mode 100644 tests/data/test898
 diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
 index 59d46bc..7ae2cf8 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
@@ -106,7 +106,7 @@ test854 test855 test856 test857 test858 test859 test860 test861 test862 \
 test863 test864 test865 test866 test867 test868 test869 test870 test871 \
 test872 test873 test874 test875 test876 test877 test878 test879 test880 \
 test881 test882 test883 test884 test885 test886 test887 test888 test889 \
 -test890 test891 test892 test893 test894 test895 test896 \
 +test890 test891 test892 test893 test894 test895 test896         test898 \
 \
 test900 test901 test902 test903 test904 test905 test906 test907 test908 \
 test909 test910 test911 test912 test913 test914 test915 test916 test917 \
 diff --git a/tests/data/test898 b/tests/data/test898
 new file mode 100644
 index 0000000..5cbb7d8
 --- /dev/null
 +++ b/tests/data/test898
@@ -0,0 +1,90 @@
 +<testcase>
 +<info>
 +<keywords>
 +HTTP
 +--location
 +Authorization
 +Cookie
 +</keywords>
 +</info>
 +
 +#
 +# Server-side
 +<reply>
 +<data>
 +HTTP/1.1 301 redirect
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
 +Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
 +
 +</data>
 +<data2>
 +HTTP/1.1 200 OK
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 4
 +Connection: close
 +Content-Type: text/html
 +
 +hey
 +</data2>
 +
 +<datacheck>
 +HTTP/1.1 301 redirect
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
 +Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
 +
 +HTTP/1.1 200 OK
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 4
 +Connection: close
 +Content-Type: text/html
 +
 +hey
 +</datacheck>
 +
 +</reply>
 +
 +#
 +# Client-side
 +<client>
 +<server>
 +http
 +</server>
 + <name>
 +HTTP with custom auth and cookies redirected to HTTP on a diff port
 + </name>
 + <command>
 +-x http://%HOSTIP:%HTTPPORT http://firsthost.com -L -H "Authorization: Basic am9lOnNlY3JldA==" -H "Cookie: userpwd=am9lOnNlY3JldA=="
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<protocol>
 +GET http://firsthost.com/ HTTP/1.1
 +Host: firsthost.com
 +User-Agent: curl/%VERSION
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +Authorization: Basic am9lOnNlY3JldA==
 +Cookie: userpwd=am9lOnNlY3JldA==
 +
 +GET http://firsthost.com:9999/a/path/%TESTNUMBER0002 HTTP/1.1
 +Host: firsthost.com:9999
 +User-Agent: curl/%VERSION
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +
 +</protocol>
 +</verify>
 +</testcase>
 -- 
 2.34.1
--- a/SOURCES/0014-curl-7.61.1-libssh-socket.patch
+++ b/SOURCES/0014-curl-7.61.1-libssh-socket.patch
@ -0,0 +1,66 @@
 From 095d4cf3b1c388b2871e3783f8c41b1e01200a25 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Felix=20H=C3=A4dicke?= <felixhaedicke@web.de>
 Date: Wed, 23 Jan 2019 23:47:55 +0100
 Subject: [PATCH] libssh: do not let libssh create socket
 By default, libssh creates a new socket, instead of using the socket
 created by curl for SSH connections.
 Pass the socket created by curl to libssh using ssh_options_set() with
 SSH_OPTIONS_FD directly after ssh_new(). So libssh uses our socket
 instead of creating a new one.
 This approach is very similar to what is done in the libssh2 code, where
 the socket created by curl is passed to libssh2 when
 libssh2_session_startup() is called.
 Fixes #3491
 Closes #3495
 Upstream-commit: 15c94b310bf9e0c92d71fca5a88eb67a1e2548a6
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/ssh-libssh.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
 diff --git a/lib/ssh-libssh.c b/lib/ssh-libssh.c
 index 7d59089..4110be2 100644
 --- a/lib/ssh-libssh.c
 +++ b/lib/ssh-libssh.c
@@ -549,6 +549,7 @@ static CURLcode myssh_statemach_act(struct connectdata *conn, bool *block)
   struct Curl_easy *data = conn->data;
   struct SSHPROTO *protop = data->req.protop;
   struct ssh_conn *sshc = &conn->proto.sshc;
 +  curl_socket_t sock = conn->sock[FIRSTSOCKET];
   int rc = SSH_NO_ERROR, err;
   char *new_readdir_line;
   int seekerr = CURL_SEEKFUNC_OK;
@@ -792,7 +793,7 @@ static CURLcode myssh_statemach_act(struct connectdata *conn, bool *block)
       Curl_pgrsTime(conn->data, TIMER_APPCONNECT);      /* SSH is connected */
 -      conn->sockfd = ssh_get_fd(sshc->ssh_session);
 +      conn->sockfd = sock;
       conn->writesockfd = CURL_SOCKET_BAD;
       if(conn->handler->protocol == CURLPROTO_SFTP) {
@@ -2048,6 +2049,7 @@ static CURLcode myssh_connect(struct connectdata *conn, bool *done)
 {
   struct ssh_conn *ssh;
   CURLcode result;
 +  curl_socket_t sock = conn->sock[FIRSTSOCKET];
   struct Curl_easy *data = conn->data;
   int rc;
@@ -2076,6 +2078,8 @@ static CURLcode myssh_connect(struct connectdata *conn, bool *done)
     return CURLE_FAILED_INIT;
   }
 +  ssh_options_set(ssh->ssh_session, SSH_OPTIONS_FD, &sock);
 +
   if(conn->user) {
     infof(data, "User: %s\n", conn->user);
     ssh_options_set(ssh->ssh_session, SSH_OPTIONS_USER, conn->user);
 -- 
 2.17.2
--- a/SOURCES/0015-curl-7.76.1-tests-openssh.patch
+++ b/SOURCES/0015-curl-7.76.1-tests-openssh.patch
@ -1,101 +0,0 @@
 From 85a8c0e9992cee271145ecf009f60b9bee9b7a60 Mon Sep 17 00:00:00 2001
 From: Kamil Dudka <kdudka@redhat.com>
 Date: Wed, 15 Sep 2021 09:59:14 +0200
 Subject: [PATCH] tests/sshserver.pl: make it work with openssh-8.7p1
 ... by not using options with no argument where an argument is required:
 === Start of file tests/log/ssh_server.log
 curl_sshd_config line 6: no argument after keyword "DenyGroups"
 curl_sshd_config line 7: no argument after keyword "AllowGroups"
 curl_sshd_config line 10: Deprecated option AuthorizedKeysFile2
 curl_sshd_config line 29: Deprecated option KeyRegenerationInterval
 curl_sshd_config line 39: Deprecated option RhostsRSAAuthentication
 curl_sshd_config line 40: Deprecated option RSAAuthentication
 curl_sshd_config line 41: Deprecated option ServerKeyBits
 curl_sshd_config line 45: Deprecated option UseLogin
 curl_sshd_config line 56: no argument after keyword "AcceptEnv"
 curl_sshd_config: terminating, 3 bad configuration options
 === End of file tests/log/ssh_server.log
 === Start of file log/sftp_server.log
 curl_sftp_config line 33: Unsupported option "rhostsrsaauthentication"
 curl_sftp_config line 34: Unsupported option "rsaauthentication"
 curl_sftp_config line 52: no argument after keyword "sendenv"
 curl_sftp_config: terminating, 1 bad configuration options
 Connection closed.
 Connection closed
 === End of file log/sftp_server.log
 Closes #7724
 Upstream-commit: ab78d2c679dfb37b27e89f42ad050c3153fa7513
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/sshserver.pl | 14 --------------
 1 file changed, 14 deletions(-)
 diff --git a/tests/sshserver.pl b/tests/sshserver.pl
 index 9441939..2afaace 100644
 --- a/tests/sshserver.pl
 +++ b/tests/sshserver.pl
@@ -428,9 +428,7 @@ if ($sshdid =~ /OpenSSH-Windows/) {
 #  ssh daemon configuration file options we might use and version support
 #
 #  AFSTokenPassing                  : OpenSSH 1.2.1 and later [1]
 -#  AcceptEnv                        : OpenSSH 3.9.0 and later
 #  AddressFamily                    : OpenSSH 4.0.0 and later
 -#  AllowGroups                      : OpenSSH 1.2.1 and later
 #  AllowTcpForwarding               : OpenSSH 2.3.0 and later
 #  AllowUsers                       : OpenSSH 1.2.1 and later
 #  AuthorizedKeysFile               : OpenSSH 2.9.9 and later
@@ -441,7 +439,6 @@ if ($sshdid =~ /OpenSSH-Windows/) {
 #  ClientAliveCountMax              : OpenSSH 2.9.0 and later
 #  ClientAliveInterval              : OpenSSH 2.9.0 and later
 #  Compression                      : OpenSSH 3.3.0 and later
 -#  DenyGroups                       : OpenSSH 1.2.1 and later
 #  DenyUsers                        : OpenSSH 1.2.1 and later
 #  ForceCommand                     : OpenSSH 4.4.0 and later [3]
 #  GatewayPorts                     : OpenSSH 2.1.0 and later
@@ -534,9 +531,6 @@ if ($sshdid =~ /OpenSSH-Windows/) {
     push @cfgarr, "AllowUsers $username";
 }
 -push @cfgarr, 'DenyGroups';
 -push @cfgarr, 'AllowGroups';
 -push @cfgarr, '#';
 push @cfgarr, "AuthorizedKeysFile $clipubkeyf_config";
 push @cfgarr, "AuthorizedKeysFile2 $clipubkeyf_config";
 push @cfgarr, "HostKey $hstprvkeyf_config";
@@ -684,9 +678,6 @@ push @cfgarr, '#';
 #***************************************************************************
 # Options that might be supported or not in sshd OpenSSH 2.9.9 and later
 #
 -if(sshd_supports_opt('AcceptEnv','')) {
 -    push @cfgarr, 'AcceptEnv';
 -}
 if(sshd_supports_opt('AddressFamily','any')) {
     # Address family must be specified before ListenAddress
     splice @cfgarr, 14, 0, 'AddressFamily any';
@@ -873,7 +864,6 @@ if ($sshdid =~ /OpenSSH-Windows/) {
 #  RemoteForward                     : OpenSSH 1.2.1 and later [3]
 #  RhostsRSAAuthentication           : OpenSSH 1.2.1 and later
 #  RSAAuthentication                 : OpenSSH 1.2.1 and later
 -#  SendEnv                           : OpenSSH 3.9.0 and later
 #  ServerAliveCountMax               : OpenSSH 3.8.0 and later
 #  ServerAliveInterval               : OpenSSH 3.8.0 and later
 #  SmartcardDevice                   : OpenSSH 2.9.9 and later [1][3]
@@ -1028,10 +1018,6 @@ if((($sshid =~ /OpenSSH/) && ($sshvernum >= 370)) ||
     push @cfgarr, 'RekeyLimit 1G';
 }
 -if(($sshid =~ /OpenSSH/) && ($sshvernum >= 390)) {
 -    push @cfgarr, 'SendEnv';
 -}
 -
 if((($sshid =~ /OpenSSH/) && ($sshvernum >= 380)) ||
    (($sshid =~ /SunSSH/) && ($sshvernum >= 120))) {
     push @cfgarr, 'ServerAliveCountMax 3';
 -- 
 2.34.1
--- a/SOURCES/0017-curl-7.64.0-CVE-2019-5436.patch
+++ b/SOURCES/0017-curl-7.64.0-CVE-2019-5436.patch
@ -0,0 +1,31 @@
 From 55a27027d5f024a0ecc2c23c81ed99de6192c9f3 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Fri, 3 May 2019 22:20:37 +0200
 Subject: [PATCH] tftp: use the current blksize for recvfrom()
 bug: https://curl.haxx.se/docs/CVE-2019-5436.html
 Reported-by: l00p3r on hackerone
 CVE-2019-5436
 Upstream-commit: 2576003415625d7b5f0e390902f8097830b82275
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/tftp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/lib/tftp.c b/lib/tftp.c
 index 269b3cd..4f2a131 100644
 --- a/lib/tftp.c
 +++ b/lib/tftp.c
@@ -1005,7 +1005,7 @@ static CURLcode tftp_connect(struct connectdata *conn, bool *done)
   state->sockfd = state->conn->sock[FIRSTSOCKET];
   state->state = TFTP_STATE_START;
   state->error = TFTP_ERR_NONE;
 -  state->blksize = TFTP_BLKSIZE_DEFAULT;
 +  state->blksize = blksize;
   state->requested_blksize = blksize;
   ((struct sockaddr *)&state->local_addr)->sa_family =
 -- 
 2.20.1
--- a/SOURCES/0018-curl-7.65.3-CVE-2019-5482.patch
+++ b/SOURCES/0018-curl-7.65.3-CVE-2019-5482.patch
@ -0,0 +1,158 @@
 From 63f9837b4ccf600da79314e8667f91bda69988fc Mon Sep 17 00:00:00 2001
 From: Thomas Vegas <>
 Date: Sat, 31 Aug 2019 16:59:56 +0200
 Subject: [PATCH 1/2] tftp: return error when packet is too small for options
 Upstream-commit: 82f3ba3806a34fe94dcf9e5c9b88deda6679ca1b
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/tftp.c | 53 +++++++++++++++++++++++++++++++++--------------------
 1 file changed, 33 insertions(+), 20 deletions(-)
 diff --git a/lib/tftp.c b/lib/tftp.c
 index 289cda2..4532170 100644
 --- a/lib/tftp.c
 +++ b/lib/tftp.c
@@ -404,13 +404,14 @@ static CURLcode tftp_parse_option_ack(tftp_state_data_t *state,
   return CURLE_OK;
 }
 -static size_t tftp_option_add(tftp_state_data_t *state, size_t csize,
 -                              char *buf, const char *option)
 +static CURLcode tftp_option_add(tftp_state_data_t *state, size_t *csize,
 +                                char *buf, const char *option)
 {
 -  if(( strlen(option) + csize + 1) > (size_t)state->blksize)
 -    return 0;
 +  if(( strlen(option) + *csize + 1) > (size_t)state->blksize)
 +    return CURLE_TFTP_ILLEGAL;
   strcpy(buf, option);
 -  return strlen(option) + 1;
 +  *csize += strlen(option) + 1;
 +  return CURLE_OK;
 }
 static CURLcode tftp_connect_for_tx(tftp_state_data_t *state,
@@ -511,26 +512,38 @@ static CURLcode tftp_send_first(tftp_state_data_t *state, tftp_event_t event)
       else
         strcpy(buf, "0"); /* the destination is large enough */
 -      sbytes += tftp_option_add(state, sbytes,
 -                                (char *)state->spacket.data + sbytes,
 -                                TFTP_OPTION_TSIZE);
 -      sbytes += tftp_option_add(state, sbytes,
 -                                (char *)state->spacket.data + sbytes, buf);
 +      result = tftp_option_add(state, &sbytes,
 +                               (char *)state->spacket.data + sbytes,
 +                               TFTP_OPTION_TSIZE);
 +      if(result == CURLE_OK)
 +        result = tftp_option_add(state, &sbytes,
 +                                 (char *)state->spacket.data + sbytes, buf);
 +
       /* add blksize option */
       snprintf(buf, sizeof(buf), "%d", state->requested_blksize);
 -      sbytes += tftp_option_add(state, sbytes,
 -                                (char *)state->spacket.data + sbytes,
 -                                TFTP_OPTION_BLKSIZE);
 -      sbytes += tftp_option_add(state, sbytes,
 -                                (char *)state->spacket.data + sbytes, buf);
 +      if(result == CURLE_OK)
 +        result = tftp_option_add(state, &sbytes,
 +                                 (char *)state->spacket.data + sbytes,
 +                                 TFTP_OPTION_BLKSIZE);
 +      if(result == CURLE_OK)
 +        result = tftp_option_add(state, &sbytes,
 +                                 (char *)state->spacket.data + sbytes, buf);
       /* add timeout option */
       snprintf(buf, sizeof(buf), "%d", state->retry_time);
 -      sbytes += tftp_option_add(state, sbytes,
 -                                (char *)state->spacket.data + sbytes,
 -                                TFTP_OPTION_INTERVAL);
 -      sbytes += tftp_option_add(state, sbytes,
 -                                (char *)state->spacket.data + sbytes, buf);
 +      if(result == CURLE_OK)
 +        result = tftp_option_add(state, &sbytes,
 +                                 (char *)state->spacket.data + sbytes,
 +                                 TFTP_OPTION_INTERVAL);
 +      if(result == CURLE_OK)
 +        result = tftp_option_add(state, &sbytes,
 +                                 (char *)state->spacket.data + sbytes, buf);
 +
 +      if(result != CURLE_OK) {
 +        failf(data, "TFTP buffer too small for options");
 +        free(filename);
 +        return CURLE_TFTP_ILLEGAL;
 +      }
     }
     /* the typecase for the 3rd argument is mostly for systems that do
 -- 
 2.20.1
 From b6b12a4cfe00c4850a1d6cee4cf267f00dee5987 Mon Sep 17 00:00:00 2001
 From: Thomas Vegas <>
 Date: Sat, 31 Aug 2019 17:30:51 +0200
 Subject: [PATCH 2/2] tftp: Alloc maximum blksize, and use default unless OACK
 is received
 Fixes potential buffer overflow from 'recvfrom()', should the server
 return an OACK without blksize.
 Bug: https://curl.haxx.se/docs/CVE-2019-5482.html
 CVE-2019-5482
 Upstream-commit: facb0e4662415b5f28163e853dc6742ac5fafb3d
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/tftp.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)
 diff --git a/lib/tftp.c b/lib/tftp.c
 index 4532170..5651b62 100644
 --- a/lib/tftp.c
 +++ b/lib/tftp.c
@@ -982,6 +982,7 @@ static CURLcode tftp_connect(struct connectdata *conn, bool *done)
 {
   tftp_state_data_t *state;
   int blksize;
 +  int need_blksize;
   blksize = TFTP_BLKSIZE_DEFAULT;
@@ -996,15 +997,20 @@ static CURLcode tftp_connect(struct connectdata *conn, bool *done)
       return CURLE_TFTP_ILLEGAL;
   }
 +  need_blksize = blksize;
 +  /* default size is the fallback when no OACK is received */
 +  if(need_blksize < TFTP_BLKSIZE_DEFAULT)
 +    need_blksize = TFTP_BLKSIZE_DEFAULT;
 +
   if(!state->rpacket.data) {
 -    state->rpacket.data = calloc(1, blksize + 2 + 2);
 +    state->rpacket.data = calloc(1, need_blksize + 2 + 2);
     if(!state->rpacket.data)
       return CURLE_OUT_OF_MEMORY;
   }
   if(!state->spacket.data) {
 -    state->spacket.data = calloc(1, blksize + 2 + 2);
 +    state->spacket.data = calloc(1, need_blksize + 2 + 2);
     if(!state->spacket.data)
       return CURLE_OUT_OF_MEMORY;
@@ -1018,7 +1024,7 @@ static CURLcode tftp_connect(struct connectdata *conn, bool *done)
   state->sockfd = state->conn->sock[FIRSTSOCKET];
   state->state = TFTP_STATE_START;
   state->error = TFTP_ERR_NONE;
 -  state->blksize = blksize;
 +  state->blksize = TFTP_BLKSIZE_DEFAULT; /* Unless updated by OACK response */
   state->requested_blksize = blksize;
   ((struct sockaddr *)&state->local_addr)->sa_family =
 -- 
 2.20.1
--- a/SOURCES/0019-curl-7.65.3-CVE-2019-5481.patch
+++ b/SOURCES/0019-curl-7.65.3-CVE-2019-5481.patch
@ -0,0 +1,46 @@
 From 13de299b112a59c373b330f0539166ecc9a7627b Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Tue, 3 Sep 2019 22:59:32 +0200
 Subject: [PATCH] security:read_data fix bad realloc()
 ... that could end up a double-free
 CVE-2019-5481
 Bug: https://curl.haxx.se/docs/CVE-2019-5481.html
 Upstream-commit: 9069838b30fb3b48af0123e39f664cea683254a5
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/security.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)
 diff --git a/lib/security.c b/lib/security.c
 index 550ea2d..c5e4e13 100644
 --- a/lib/security.c
 +++ b/lib/security.c
@@ -191,7 +191,6 @@ static CURLcode read_data(struct connectdata *conn,
                           struct krb5buffer *buf)
 {
   int len;
 -  void *tmp = NULL;
   CURLcode result;
   result = socket_read(fd, &len, sizeof(len));
@@ -201,12 +200,11 @@ static CURLcode read_data(struct connectdata *conn,
   if(len) {
     /* only realloc if there was a length */
     len = ntohl(len);
 -    tmp = Curl_saferealloc(buf->data, len);
 +    buf->data = Curl_saferealloc(buf->data, len);
   }
 -  if(tmp == NULL)
 +  if(!len || !buf->data)
     return CURLE_OUT_OF_MEMORY;
 -  buf->data = tmp;
   result = socket_read(fd, buf->data, len);
   if(result)
     return result;
 -- 
 2.20.1
--- a/SOURCES/0019-curl-7.76.1-CVE-2022-32207.patch
+++ b/SOURCES/0019-curl-7.76.1-CVE-2022-32207.patch
@ -1,425 +0,0 @@
 From 36b47377c2d1a8d141d1ef810102748f27384f5c Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Wed, 25 May 2022 10:09:53 +0200
 Subject: [PATCH 1/3] fopen: add Curl_fopen() for better overwriting of files
 Bug: https://curl.se/docs/CVE-2022-32207.html
 CVE-2022-32207
 Reported-by: Harry Sintonen
 Closes #9050
 Upstream-commit: 20f9dd6bae50b7223171b17ba7798946e74f877f
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 CMakeLists.txt          |   1 +
 configure.ac            |   1 +
 lib/Makefile.inc        |   2 +
 lib/cookie.c            |  17 ++----
 lib/curl_config.h.cmake |   3 ++
 lib/fopen.c             | 113 ++++++++++++++++++++++++++++++++++++++++
 lib/fopen.h             |  30 +++++++++++
 7 files changed, 154 insertions(+), 13 deletions(-)
 create mode 100644 lib/fopen.c
 create mode 100644 lib/fopen.h
 diff --git a/CMakeLists.txt b/CMakeLists.txt
 index b77de6d..a0bfaad 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
@@ -982,6 +982,7 @@ elseif(HAVE_LIBSOCKET)
   set(CMAKE_REQUIRED_LIBRARIES socket)
 endif()
 +check_symbol_exists(fchmod        "${CURL_INCLUDES}" HAVE_FCHMOD)
 check_symbol_exists(basename      "${CURL_INCLUDES}" HAVE_BASENAME)
 check_symbol_exists(socket        "${CURL_INCLUDES}" HAVE_SOCKET)
 check_symbol_exists(select        "${CURL_INCLUDES}" HAVE_SELECT)
 diff --git a/configure.ac b/configure.ac
 index d431870..7433bb9 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -4516,6 +4516,7 @@ AC_CHECK_DECLS([getpwuid_r], [], [AC_DEFINE(HAVE_DECL_GETPWUID_R_MISSING, 1, "Se
 AC_CHECK_FUNCS([fnmatch \
 +  fchmod \
   geteuid \
   getpass_r \
   getppid \
 diff --git a/lib/Makefile.inc b/lib/Makefile.inc
 index e8f110f..5139b03 100644
 --- a/lib/Makefile.inc
 +++ b/lib/Makefile.inc
@@ -130,6 +130,7 @@ LIB_CFILES =         \
   escape.c           \
   file.c             \
   fileinfo.c         \
 +  fopen.c            \
   formdata.c         \
   ftp.c              \
   ftplistparser.c    \
@@ -261,6 +262,7 @@ LIB_HFILES =         \
   escape.h           \
   file.h             \
   fileinfo.h         \
 +  fopen.h            \
   formdata.h         \
   ftp.h              \
   ftplistparser.h    \
 diff --git a/lib/cookie.c b/lib/cookie.c
 index 8a6aa1a..cb0c03b 100644
 --- a/lib/cookie.c
 +++ b/lib/cookie.c
@@ -97,8 +97,8 @@ Example set of cookies:
 #include "curl_memrchr.h"
 #include "inet_pton.h"
 #include "parsedate.h"
 -#include "rand.h"
 #include "rename.h"
 +#include "fopen.h"
 /* The last 3 #include files should be in this order */
 #include "curl_printf.h"
@@ -1537,17 +1537,8 @@ static int cookie_output(struct Curl_easy *data,
     use_stdout = TRUE;
   }
   else {
 -    unsigned char randsuffix[9];
 -
 -    if(Curl_rand_hex(data, randsuffix, sizeof(randsuffix)))
 -      return 2;
 -
 -    tempstore = aprintf("%s.%s.tmp", filename, randsuffix);
 -    if(!tempstore)
 -      return 1;
 -
 -    out = fopen(tempstore, FOPEN_WRITETEXT);
 -    if(!out)
 +    error = Curl_fopen(data, filename, &out, &tempstore);
 +    if(error)
       goto error;
   }
@@ -1594,7 +1585,7 @@ static int cookie_output(struct Curl_easy *data,
   if(!use_stdout) {
     fclose(out);
     out = NULL;
 -    if(Curl_rename(tempstore, filename)) {
 +    if(tempstore && Curl_rename(tempstore, filename)) {
       unlink(tempstore);
       goto error;
     }
 diff --git a/lib/curl_config.h.cmake b/lib/curl_config.h.cmake
 index d2a0f43..c254359 100644
 --- a/lib/curl_config.h.cmake
 +++ b/lib/curl_config.h.cmake
@@ -148,6 +148,9 @@
 /* Define to 1 if you have the <assert.h> header file. */
 #cmakedefine HAVE_ASSERT_H 1
 +/* Define to 1 if you have the `fchmod' function. */
 +#cmakedefine HAVE_FCHMOD 1
 +
 /* Define to 1 if you have the `basename' function. */
 #cmakedefine HAVE_BASENAME 1
 diff --git a/lib/fopen.c b/lib/fopen.c
 new file mode 100644
 index 0000000..ad3691b
 --- /dev/null
 +++ b/lib/fopen.c
@@ -0,0 +1,113 @@
 +/***************************************************************************
 + *                                  _   _ ____  _
 + *  Project                     ___| | | |  _ \| |
 + *                             / __| | | | |_) | |
 + *                            | (__| |_| |  _ <| |___
 + *                             \___|\___/|_| \_\_____|
 + *
 + * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
 + *
 + * This software is licensed as described in the file COPYING, which
 + * you should have received as part of this distribution. The terms
 + * are also available at https://curl.se/docs/copyright.html.
 + *
 + * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 + * copies of the Software, and permit persons to whom the Software is
 + * furnished to do so, under the terms of the COPYING file.
 + *
 + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
 + * KIND, either express or implied.
 + *
 + * SPDX-License-Identifier: curl
 + *
 + ***************************************************************************/
 +
 +#include "curl_setup.h"
 +
 +#if !defined(CURL_DISABLE_COOKIES) || !defined(CURL_DISABLE_ALTSVC) ||  \
 +  defined(USE_HSTS)
 +
 +#ifdef HAVE_FCNTL_H
 +#include <fcntl.h>
 +#endif
 +
 +#include "urldata.h"
 +#include "rand.h"
 +#include "fopen.h"
 +/* The last 3 #include files should be in this order */
 +#include "curl_printf.h"
 +#include "curl_memory.h"
 +#include "memdebug.h"
 +
 +/*
 + * Curl_fopen() opens a file for writing with a temp name, to be renamed
 + * to the final name when completed. If there is an existing file using this
 + * name at the time of the open, this function will clone the mode from that
 + * file.  if 'tempname' is non-NULL, it needs a rename after the file is
 + * written.
 + */
 +CURLcode Curl_fopen(struct Curl_easy *data, const char *filename,
 +                    FILE **fh, char **tempname)
 +{
 +  CURLcode result = CURLE_WRITE_ERROR;
 +  unsigned char randsuffix[9];
 +  char *tempstore = NULL;
 +  struct_stat sb;
 +  int fd = -1;
 +  *tempname = NULL;
 +
 +  if(stat(filename, &sb) == -1 || !S_ISREG(sb.st_mode)) {
 +    /* a non-regular file, fallback to direct fopen() */
 +    *fh = fopen(filename, FOPEN_WRITETEXT);
 +    if(*fh)
 +      return CURLE_OK;
 +    goto fail;
 +  }
 +
 +  result = Curl_rand_hex(data, randsuffix, sizeof(randsuffix));
 +  if(result)
 +    goto fail;
 +
 +  tempstore = aprintf("%s.%s.tmp", filename, randsuffix);
 +  if(!tempstore) {
 +    result = CURLE_OUT_OF_MEMORY;
 +    goto fail;
 +  }
 +
 +  result = CURLE_WRITE_ERROR;
 +  fd = open(tempstore, O_WRONLY | O_CREAT | O_EXCL, 0600);
 +  if(fd == -1)
 +    goto fail;
 +
 +#ifdef HAVE_FCHMOD
 +  {
 +    struct_stat nsb;
 +    if((fstat(fd, &nsb) != -1) &&
 +       (nsb.st_uid == sb.st_uid) && (nsb.st_gid == sb.st_gid)) {
 +      /* if the user and group are the same, clone the original mode */
 +      if(fchmod(fd, sb.st_mode) == -1)
 +        goto fail;
 +    }
 +  }
 +#endif
 +
 +  *fh = fdopen(fd, FOPEN_WRITETEXT);
 +  if(!*fh)
 +    goto fail;
 +
 +  *tempname = tempstore;
 +  return CURLE_OK;
 +
 +fail:
 +  if(fd != -1) {
 +    close(fd);
 +    unlink(tempstore);
 +  }
 +
 +  free(tempstore);
 +
 +  *tempname = NULL;
 +  return result;
 +}
 +
 +#endif /* ! disabled */
 diff --git a/lib/fopen.h b/lib/fopen.h
 new file mode 100644
 index 0000000..289e55f
 --- /dev/null
 +++ b/lib/fopen.h
@@ -0,0 +1,30 @@
 +#ifndef HEADER_CURL_FOPEN_H
 +#define HEADER_CURL_FOPEN_H
 +/***************************************************************************
 + *                                  _   _ ____  _
 + *  Project                     ___| | | |  _ \| |
 + *                             / __| | | | |_) | |
 + *                            | (__| |_| |  _ <| |___
 + *                             \___|\___/|_| \_\_____|
 + *
 + * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
 + *
 + * This software is licensed as described in the file COPYING, which
 + * you should have received as part of this distribution. The terms
 + * are also available at https://curl.se/docs/copyright.html.
 + *
 + * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 + * copies of the Software, and permit persons to whom the Software is
 + * furnished to do so, under the terms of the COPYING file.
 + *
 + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
 + * KIND, either express or implied.
 + *
 + * SPDX-License-Identifier: curl
 + *
 + ***************************************************************************/
 +
 +CURLcode Curl_fopen(struct Curl_easy *data, const char *filename,
 +                    FILE **fh, char **tempname);
 +
 +#endif
 -- 
 2.35.3
 From bd7af48238b058e9b46fdf2e1333b355920c341c Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Wed, 25 May 2022 10:09:53 +0200
 Subject: [PATCH 2/3] altsvc: use Curl_fopen()
 Upstream-commit: fab970a5d19c1faa2052239ec1e2602b892cbeb2
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/altsvc.c | 22 ++++++----------------
 1 file changed, 6 insertions(+), 16 deletions(-)
 diff --git a/lib/altsvc.c b/lib/altsvc.c
 index 242733b..4dc4078 100644
 --- a/lib/altsvc.c
 +++ b/lib/altsvc.c
@@ -34,7 +34,7 @@
 #include "parsedate.h"
 #include "sendf.h"
 #include "warnless.h"
 -#include "rand.h"
 +#include "fopen.h"
 #include "rename.h"
 /* The last 3 #include files should be in this order */
@@ -329,8 +329,7 @@ CURLcode Curl_altsvc_save(struct Curl_easy *data,
   struct Curl_llist_element *n;
   CURLcode result = CURLE_OK;
   FILE *out;
 -  char *tempstore;
 -  unsigned char randsuffix[9];
 +  char *tempstore = NULL;
   if(!altsvc)
     /* no cache activated */
@@ -344,17 +343,8 @@ CURLcode Curl_altsvc_save(struct Curl_easy *data,
     /* marked as read-only, no file or zero length file name */
     return CURLE_OK;
 -  if(Curl_rand_hex(data, randsuffix, sizeof(randsuffix)))
 -    return CURLE_FAILED_INIT;
 -
 -  tempstore = aprintf("%s.%s.tmp", file, randsuffix);
 -  if(!tempstore)
 -    return CURLE_OUT_OF_MEMORY;
 -
 -  out = fopen(tempstore, FOPEN_WRITETEXT);
 -  if(!out)
 -    result = CURLE_WRITE_ERROR;
 -  else {
 +  result = Curl_fopen(data, file, &out, &tempstore);
 +  if(!result) {
     fputs("# Your alt-svc cache. https://curl.se/docs/alt-svc.html\n"
           "# This file was generated by libcurl! Edit at your own risk.\n",
           out);
@@ -366,10 +356,10 @@ CURLcode Curl_altsvc_save(struct Curl_easy *data,
         break;
     }
     fclose(out);
 -    if(!result && Curl_rename(tempstore, file))
 +    if(!result && tempstore && Curl_rename(tempstore, file))
       result = CURLE_WRITE_ERROR;
 -    if(result)
 +    if(result && tempstore)
       unlink(tempstore);
   }
   free(tempstore);
 -- 
 2.35.3
 From 2011622a36fa715f38277422241e77e25dfdf0d0 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Wed, 25 May 2022 10:09:54 +0200
 Subject: [PATCH 3/3] hsts: use Curl_fopen()
 Upstream-commit: d64115d7bb8ae4c136b620912da523c063f1d2ee
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/hsts.c | 22 ++++++----------------
 1 file changed, 6 insertions(+), 16 deletions(-)
 diff --git a/lib/hsts.c b/lib/hsts.c
 index b9fa6f7..9d54c82 100644
 --- a/lib/hsts.c
 +++ b/lib/hsts.c
@@ -35,7 +35,7 @@
 #include "sendf.h"
 #include "strtoofft.h"
 #include "parsedate.h"
 -#include "rand.h"
 +#include "fopen.h"
 #include "rename.h"
 /* The last 3 #include files should be in this order */
@@ -316,8 +316,7 @@ CURLcode Curl_hsts_save(struct Curl_easy *data, struct hsts *h,
   struct Curl_llist_element *n;
   CURLcode result = CURLE_OK;
   FILE *out;
 -  char *tempstore;
 -  unsigned char randsuffix[9];
 +  char *tempstore = NULL;
   if(!h)
     /* no cache activated */
@@ -331,17 +330,8 @@ CURLcode Curl_hsts_save(struct Curl_easy *data, struct hsts *h,
     /* marked as read-only, no file or zero length file name */
     goto skipsave;
 -  if(Curl_rand_hex(data, randsuffix, sizeof(randsuffix)))
 -    return CURLE_FAILED_INIT;
 -
 -  tempstore = aprintf("%s.%s.tmp", file, randsuffix);
 -  if(!tempstore)
 -    return CURLE_OUT_OF_MEMORY;
 -
 -  out = fopen(tempstore, FOPEN_WRITETEXT);
 -  if(!out)
 -    result = CURLE_WRITE_ERROR;
 -  else {
 +  result = Curl_fopen(data, file, &out, &tempstore);
 +  if(!result) {
     fputs("# Your HSTS cache. https://curl.se/docs/hsts.html\n"
           "# This file was generated by libcurl! Edit at your own risk.\n",
           out);
@@ -353,10 +343,10 @@ CURLcode Curl_hsts_save(struct Curl_easy *data, struct hsts *h,
         break;
     }
     fclose(out);
 -    if(!result && Curl_rename(tempstore, file))
 +    if(!result && tempstore && Curl_rename(tempstore, file))
       result = CURLE_WRITE_ERROR;
 -    if(result)
 +    if(result && tempstore)
       unlink(tempstore);
   }
   free(tempstore);
 -- 
 2.35.3
--- a/SOURCES/0020-curl-7.61.1-openssl-engines.patch
+++ b/SOURCES/0020-curl-7.61.1-openssl-engines.patch
@ -0,0 +1,33 @@
 From 032843be4cefcb163d15573d15a228680e771106 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 24 Sep 2018 08:26:58 +0200
 Subject: [PATCH] openssl: load built-in engines too
 Regression since 38203f1
 Reported-by: Jean Fabrice
 Fixes #3023
 Closes #3040
 Upstream-commit: e2dd435d473cdc97785df95d032276fafb4b7746
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/vtls/openssl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
 index 78970d1..d8bcc4f 100644
 --- a/lib/vtls/openssl.c
 +++ b/lib/vtls/openssl.c
@@ -979,7 +979,7 @@ static int Curl_ossl_init(void)
   OPENSSL_load_builtin_modules();
 -#ifdef HAVE_ENGINE_LOAD_BUILTIN_ENGINES
 +#ifdef USE_OPENSSL_ENGINE
   ENGINE_load_builtin_engines();
 #endif
 -- 
 2.25.4
--- a/SOURCES/0020-curl-7.76.1-openldap-rebase.patch
+++ b/SOURCES/0020-curl-7.76.1-openldap-rebase.patch
@ -1,186 +0,0 @@
 From c2acc48854be9f8590e57a7b44b649fb8537bed4 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Tue, 4 May 2021 16:14:13 +0200
 Subject: [PATCH] openldap: replace ldap_ prefix on private functions
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Since openldap itself uses that prefix and with OpenĹDAP 2.5.4 (at
 least) there's a symbol collision because of that.
 The private functions now use the 'oldap_' prefix where it previously
 used 'ldap_'.
 Reported-by: 3eka on github
 Fixes #7004
 Closes #7005
 Upstream-commit: 8bdde6b14ce3b5fd71c772a578fcbd4b6fa6df19
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/openldap.c | 67 +++++++++++++++++++++++++-------------------------
 1 file changed, 34 insertions(+), 33 deletions(-)
 diff --git a/lib/openldap.c b/lib/openldap.c
 index b515554..5a32c74 100644
 --- a/lib/openldap.c
 +++ b/lib/openldap.c
@@ -76,16 +76,16 @@ extern int ldap_init_fd(ber_socket_t fd, int proto, const char *url,
                         LDAP **ld);
 #endif
 -static CURLcode ldap_setup_connection(struct Curl_easy *data,
 -                                      struct connectdata *conn);
 -static CURLcode ldap_do(struct Curl_easy *data, bool *done);
 -static CURLcode ldap_done(struct Curl_easy *data, CURLcode, bool);
 -static CURLcode ldap_connect(struct Curl_easy *data, bool *done);
 -static CURLcode ldap_connecting(struct Curl_easy *data, bool *done);
 -static CURLcode ldap_disconnect(struct Curl_easy *data,
 -                                struct connectdata *conn, bool dead);
 +static CURLcode oldap_setup_connection(struct Curl_easy *data,
 +                                       struct connectdata *conn);
 +static CURLcode oldap_do(struct Curl_easy *data, bool *done);
 +static CURLcode oldap_done(struct Curl_easy *data, CURLcode, bool);
 +static CURLcode oldap_connect(struct Curl_easy *data, bool *done);
 +static CURLcode oldap_connecting(struct Curl_easy *data, bool *done);
 +static CURLcode oldap_disconnect(struct Curl_easy *data,
 +                                 struct connectdata *conn, bool dead);
 -static Curl_recv ldap_recv;
 +static Curl_recv oldap_recv;
 /*
  * LDAP protocol handler.
@@ -93,18 +93,18 @@ static Curl_recv ldap_recv;
 const struct Curl_handler Curl_handler_ldap = {
   "LDAP",                               /* scheme */
 -  ldap_setup_connection,                /* setup_connection */
 -  ldap_do,                              /* do_it */
 -  ldap_done,                            /* done */
 +  oldap_setup_connection,               /* setup_connection */
 +  oldap_do,                             /* do_it */
 +  oldap_done,                           /* done */
   ZERO_NULL,                            /* do_more */
 -  ldap_connect,                         /* connect_it */
 -  ldap_connecting,                      /* connecting */
 +  oldap_connect,                        /* connect_it */
 +  oldap_connecting,                     /* connecting */
   ZERO_NULL,                            /* doing */
   ZERO_NULL,                            /* proto_getsock */
   ZERO_NULL,                            /* doing_getsock */
   ZERO_NULL,                            /* domore_getsock */
   ZERO_NULL,                            /* perform_getsock */
 -  ldap_disconnect,                      /* disconnect */
 +  oldap_disconnect,                     /* disconnect */
   ZERO_NULL,                            /* readwrite */
   ZERO_NULL,                            /* connection_check */
   ZERO_NULL,                            /* attach connection */
@@ -121,18 +121,18 @@ const struct Curl_handler Curl_handler_ldap = {
 const struct Curl_handler Curl_handler_ldaps = {
   "LDAPS",                              /* scheme */
 -  ldap_setup_connection,                /* setup_connection */
 -  ldap_do,                              /* do_it */
 -  ldap_done,                            /* done */
 +  oldap_setup_connection,               /* setup_connection */
 +  oldap_do,                             /* do_it */
 +  oldap_done,                           /* done */
   ZERO_NULL,                            /* do_more */
 -  ldap_connect,                         /* connect_it */
 -  ldap_connecting,                      /* connecting */
 +  oldap_connect,                        /* connect_it */
 +  oldap_connecting,                     /* connecting */
   ZERO_NULL,                            /* doing */
   ZERO_NULL,                            /* proto_getsock */
   ZERO_NULL,                            /* doing_getsock */
   ZERO_NULL,                            /* domore_getsock */
   ZERO_NULL,                            /* perform_getsock */
 -  ldap_disconnect,                      /* disconnect */
 +  oldap_disconnect,                     /* disconnect */
   ZERO_NULL,                            /* readwrite */
   ZERO_NULL,                            /* connection_check */
   ZERO_NULL,                            /* attach connection */
@@ -173,8 +173,8 @@ struct ldapreqinfo {
   int nument;
 };
 -static CURLcode ldap_setup_connection(struct Curl_easy *data,
 -                                      struct connectdata *conn)
 +static CURLcode oldap_setup_connection(struct Curl_easy *data,
 +                                       struct connectdata *conn)
 {
   struct ldapconninfo *li;
   LDAPURLDesc *lud;
@@ -209,7 +209,7 @@ static CURLcode ldap_setup_connection(struct Curl_easy *data,
 static Sockbuf_IO ldapsb_tls;
 #endif
 -static CURLcode ldap_connect(struct Curl_easy *data, bool *done)
 +static CURLcode oldap_connect(struct Curl_easy *data, bool *done)
 {
   struct connectdata *conn = data->conn;
   struct ldapconninfo *li = conn->proto.ldapc;
@@ -257,7 +257,7 @@ static CURLcode ldap_connect(struct Curl_easy *data, bool *done)
   return CURLE_OK;
 }
 -static CURLcode ldap_connecting(struct Curl_easy *data, bool *done)
 +static CURLcode oldap_connecting(struct Curl_easy *data, bool *done)
 {
   struct connectdata *conn = data->conn;
   struct ldapconninfo *li = conn->proto.ldapc;
@@ -356,14 +356,15 @@ static CURLcode ldap_connecting(struct Curl_easy *data, bool *done)
   if(info)
     ldap_memfree(info);
 -  conn->recv[FIRSTSOCKET] = ldap_recv;
 +  conn->recv[FIRSTSOCKET] = oldap_recv;
   *done = TRUE;
   return CURLE_OK;
 }
 -static CURLcode ldap_disconnect(struct Curl_easy *data,
 -                                struct connectdata *conn, bool dead_connection)
 +static CURLcode oldap_disconnect(struct Curl_easy *data,
 +                                 struct connectdata *conn,
 +                                 bool dead_connection)
 {
   struct ldapconninfo *li = conn->proto.ldapc;
   (void) dead_connection;
@@ -384,7 +385,7 @@ static CURLcode ldap_disconnect(struct Curl_easy *data,
   return CURLE_OK;
 }
 -static CURLcode ldap_do(struct Curl_easy *data, bool *done)
 +static CURLcode oldap_do(struct Curl_easy *data, bool *done)
 {
   struct connectdata *conn = data->conn;
   struct ldapconninfo *li = conn->proto.ldapc;
@@ -429,8 +430,8 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
   return CURLE_OK;
 }
 -static CURLcode ldap_done(struct Curl_easy *data, CURLcode res,
 -                          bool premature)
 +static CURLcode oldap_done(struct Curl_easy *data, CURLcode res,
 +                           bool premature)
 {
   struct connectdata *conn = data->conn;
   struct ldapreqinfo *lr = data->req.p.ldap;
@@ -452,8 +453,8 @@ static CURLcode ldap_done(struct Curl_easy *data, CURLcode res,
   return CURLE_OK;
 }
 -static ssize_t ldap_recv(struct Curl_easy *data, int sockindex, char *buf,
 -                         size_t len, CURLcode *err)
 +static ssize_t oldap_recv(struct Curl_easy *data, int sockindex, char *buf,
 +                          size_t len, CURLcode *err)
 {
   struct connectdata *conn = data->conn;
   struct ldapconninfo *li = conn->proto.ldapc;
 -- 
 2.35.3
--- a/SOURCES/0021-curl-7.61.1-CVE-2020-8177.patch
+++ b/SOURCES/0021-curl-7.61.1-CVE-2020-8177.patch
@ -0,0 +1,59 @@
 From a6fcd8a32f3b1c5d80e524f8b2c1de32e6ecdb2b Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Sun, 31 May 2020 23:09:59 +0200
 Subject: [PATCH] tool_getparam: -i is not OK if -J is used
 Reported-by: sn on hackerone
 Bug: https://curl.haxx.se/docs/CVE-2020-8177.html
 Upstream-commit: 8236aba58542c5f89f1d41ca09d84579efb05e22
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 src/tool_cb_hdr.c   | 13 ++++---------
 src/tool_getparam.c |  5 +++++
 2 files changed, 9 insertions(+), 9 deletions(-)
 diff --git a/src/tool_cb_hdr.c b/src/tool_cb_hdr.c
 index 3b10238..b80707f 100644
 --- a/src/tool_cb_hdr.c
 +++ b/src/tool_cb_hdr.c
@@ -132,16 +132,11 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
       filename = parse_filename(p, len);
       if(filename) {
         if(outs->stream) {
 -          /* already opened and possibly written to */
 -          if(outs->fopened)
 -            fclose(outs->stream);
 -          outs->stream = NULL;
 -
 -          /* rename the initial file name to the new file name */
 -          rename(outs->filename, filename);
 -          if(outs->alloc_filename)
 -            free(outs->filename);
 +          /* indication of problem, get out! */
 +          free(filename);
 +          return failure;
         }
 +
         outs->is_cd_filename = TRUE;
         outs->s_isreg = TRUE;
         outs->fopened = FALSE;
 diff --git a/src/tool_getparam.c b/src/tool_getparam.c
 index 764caa2..c5c7429 100644
 --- a/src/tool_getparam.c
 +++ b/src/tool_getparam.c
@@ -1745,6 +1745,11 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
       }
       break;
     case 'i':
 +      if(config->content_disposition) {
 +        warnf(global,
 +              "--include and --remote-header-name cannot be combined.\n");
 +        return PARAM_BAD_USE;
 +      }
       config->show_headers = toggle; /* show the headers as well in the
                                         general output stream */
       break;
 -- 
 2.21.3
--- a/SOURCES/0022-curl-7.61.1-CVE-2020-8231.patch
+++ b/SOURCES/0022-curl-7.61.1-CVE-2020-8231.patch
@ -0,0 +1,143 @@
 From 7a26092a9e21f1e0dc3cad69a580a7e2c7822ad0 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Sun, 16 Aug 2020 11:34:35 +0200
 Subject: [PATCH] Curl_easy: remember last connection by id, not by pointer
 CVE-2020-8231
 Bug: https://curl.haxx.se/docs/CVE-2020-8231.html
 Reported-by: Marc Aldorasi
 Closes #5824
 Upstream-commit: 3c9e021f86872baae412a427e807fbfa2f3e8a22
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/connect.c | 19 ++++++++++---------
 lib/easy.c    |  3 +--
 lib/multi.c   |  5 +++--
 lib/url.c     |  2 +-
 lib/urldata.h |  2 +-
 5 files changed, 16 insertions(+), 15 deletions(-)
 diff --git a/lib/connect.c b/lib/connect.c
 index 41f2202..f724646 100644
 --- a/lib/connect.c
 +++ b/lib/connect.c
@@ -1214,15 +1214,15 @@ CURLcode Curl_connecthost(struct connectdata *conn,  /* context */
 }
 struct connfind {
 -  struct connectdata *tofind;
 -  bool found;
 +  long id_tofind;
 +  struct connectdata *found;
 };
 static int conn_is_conn(struct connectdata *conn, void *param)
 {
   struct connfind *f = (struct connfind *)param;
 -  if(conn == f->tofind) {
 -    f->found = TRUE;
 +  if(conn->connection_id == f->id_tofind) {
 +    f->found = conn;
     return 1;
   }
   return 0;
@@ -1244,21 +1244,22 @@ curl_socket_t Curl_getconnectinfo(struct Curl_easy *data,
    * - that is associated with a multi handle, and whose connection
    *   was detached with CURLOPT_CONNECT_ONLY
    */
 -  if(data->state.lastconnect && (data->multi_easy || data->multi)) {
 -    struct connectdata *c = data->state.lastconnect;
 +  if((data->state.lastconnect_id != -1) && (data->multi_easy || data->multi)) {
 +    struct connectdata *c;
     struct connfind find;
 -    find.tofind = data->state.lastconnect;
 -    find.found = FALSE;
 +    find.id_tofind = data->state.lastconnect_id;
 +    find.found = NULL;
     Curl_conncache_foreach(data, data->multi_easy?
                            &data->multi_easy->conn_cache:
                            &data->multi->conn_cache, &find, conn_is_conn);
     if(!find.found) {
 -      data->state.lastconnect = NULL;
 +      data->state.lastconnect_id = -1;
       return CURL_SOCKET_BAD;
     }
 +    c = find.found;
     if(connp) {
       /* only store this if the caller cares for it */
       *connp = c;
 diff --git a/lib/easy.c b/lib/easy.c
 index 027d0be..fe61cdd 100644
 --- a/lib/easy.c
 +++ b/lib/easy.c
@@ -919,8 +919,7 @@ struct Curl_easy *curl_easy_duphandle(struct Curl_easy *data)
   /* the connection cache is setup on demand */
   outcurl->state.conn_cache = NULL;
 -
 -  outcurl->state.lastconnect = NULL;
 +  outcurl->state.lastconnect_id = -1;
   outcurl->progress.flags    = data->progress.flags;
   outcurl->progress.callback = data->progress.callback;
 diff --git a/lib/multi.c b/lib/multi.c
 index 0caf943..0f57fd5 100644
 --- a/lib/multi.c
 +++ b/lib/multi.c
@@ -427,6 +427,7 @@ CURLMcode curl_multi_add_handle(struct Curl_multi *multi,
     data->state.conn_cache = &data->share->conn_cache;
   else
     data->state.conn_cache = &multi->conn_cache;
 +  data->state.lastconnect_id = -1;
 #ifdef USE_LIBPSL
   /* Do the same for PSL. */
@@ -644,11 +645,11 @@ static CURLcode multi_done(struct connectdata **connp,
     /* the connection is no longer in use by this transfer */
     if(Curl_conncache_return_conn(conn)) {
       /* remember the most recently used connection */
 -      data->state.lastconnect = conn;
 +      data->state.lastconnect_id = conn->connection_id;
       infof(data, "%s\n", buffer);
     }
     else
 -      data->state.lastconnect = NULL;
 +      data->state.lastconnect_id = -1;
   }
   *connp = NULL; /* to make the caller of this function better detect that
 diff --git a/lib/url.c b/lib/url.c
 index dcc6cc8..d65d17d 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -592,7 +592,7 @@ CURLcode Curl_open(struct Curl_easy **curl)
       Curl_initinfo(data);
       /* most recent connection is not yet defined */
 -      data->state.lastconnect = NULL;
 +      data->state.lastconnect_id = -1;
       data->progress.flags |= PGRS_HIDE;
       data->state.current_speed = -1; /* init to negative == impossible */
 diff --git a/lib/urldata.h b/lib/urldata.h
 index 67db3b2..4b70cc5 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -1219,7 +1219,7 @@ struct UrlState {
   /* buffers to store authentication data in, as parsed from input options */
   struct curltime keeps_speed; /* for the progress meter really */
 -  struct connectdata *lastconnect; /* The last connection, NULL if undefined */
 +  long lastconnect_id; /* The last connection, -1 if undefined */
   char *headerbuff; /* allocated buffer to store headers in */
   size_t headersize;   /* size of the allocation */
 -- 
 2.25.4
--- a/SOURCES/0022-curl-7.76.1-CVE-2022-32221.patch
+++ b/SOURCES/0022-curl-7.76.1-CVE-2022-32221.patch
@ -1,251 +0,0 @@
 From 08a53016db649bdf4f65c42a9704d35e052be7eb Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 15 Sep 2022 09:22:45 +0200
 Subject: [PATCH 1/2] setopt: when POST is set, reset the 'upload' field
 Reported-by: RobBotic1 on github
 Fixes #9507
 Closes #9511
 Upstream-commit: a64e3e59938abd7d667e4470a18072a24d7e9de9
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/setopt.c | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/lib/setopt.c b/lib/setopt.c
 index d5e3b50..b8793b4 100644
 --- a/lib/setopt.c
 +++ b/lib/setopt.c
@@ -628,6 +628,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
     }
     else
       data->set.method = HTTPREQ_GET;
 +    data->set.upload = FALSE;
     break;
   case CURLOPT_HTTPPOST:
 -- 
 2.37.3
 From a5e36349807b98d31a16bd220f6434289465e16a Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 15 Sep 2022 09:23:33 +0200
 Subject: [PATCH 2/2] test1948: verify PUT + POST reusing the same handle
 Reproduced #9507, verifies the fix
 Upstream-commit: 1edb15925e350be3b891f8a8de86600b22c0bb20
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/data/Makefile.inc    |  1 +
 tests/data/test1948        | 73 +++++++++++++++++++++++++++++++++++
 tests/libtest/Makefile.inc |  5 +++
 tests/libtest/lib1948.c    | 79 ++++++++++++++++++++++++++++++++++++++
 4 files changed, 158 insertions(+)
 create mode 100644 tests/data/test1948
 create mode 100644 tests/libtest/lib1948.c
 diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
 index 818ee08..0cfab9b 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
@@ -217,6 +217,7 @@ test1908 test1909 test1910 test1911 test1912 test1913 test1914 test1915 \
 test1916 test1917 test1918 \
 \
 test1933 test1934 test1935 test1936 \
 +test1948 \
 \
 test2000 test2001 test2002 test2003 test2004 test2005 test2006 test2007 \
 test2008 test2009 test2010 test2011 test2012 test2013 test2014 test2015 \
 diff --git a/tests/data/test1948 b/tests/data/test1948
 new file mode 100644
 index 0000000..639523d
 --- /dev/null
 +++ b/tests/data/test1948
@@ -0,0 +1,73 @@
 +<testcase>
 +<info>
 +<keywords>
 +HTTP
 +HTTP POST
 +HTTP PUT
 +</keywords>
 +</info>
 +
 +# Server-side
 +<reply>
 +<data>
 +HTTP/1.1 200 OK
 +Date: Thu, 01 Nov 2001 14:49:00 GMT
 +Content-Type: text/html
 +Content-Length: 6
 +
 +hello
 +</data>
 +<datacheck>
 +HTTP/1.1 200 OK
 +Date: Thu, 01 Nov 2001 14:49:00 GMT
 +Content-Type: text/html
 +Content-Length: 6
 +
 +hello
 +HTTP/1.1 200 OK
 +Date: Thu, 01 Nov 2001 14:49:00 GMT
 +Content-Type: text/html
 +Content-Length: 6
 +
 +hello
 +</datacheck>
 +</reply>
 +
 +# Client-side
 +<client>
 +<server>
 +http
 +</server>
 +
 +<name>
 +CURLOPT_POST after CURLOPT_UPLOAD reusing handle
 +</name>
 +<tool>
 +lib%TESTNUMBER
 +</tool>
 +
 +<command>
 +http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 +</command>
 +</client>
 +
 +# Verify data after the test has been "shot"
 +<verify>
 +<protocol>
 +PUT /%TESTNUMBER HTTP/1.1
 +Host: %HOSTIP:%HTTPPORT
 +Accept: */*
 +Content-Length: 22
 +Expect: 100-continue
 +
 +This is test PUT data
 +POST /1948 HTTP/1.1
 +Host: %HOSTIP:%HTTPPORT
 +Accept: */*
 +Content-Length: 22
 +Content-Type: application/x-www-form-urlencoded
 +
 +This is test PUT data
 +</protocol>
 +</verify>
 +</testcase>
 diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
 index 83a8af4..3192eca 100644
 --- a/tests/libtest/Makefile.inc
 +++ b/tests/libtest/Makefile.inc
@@ -61,6 +61,7 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect                \
  lib1591 lib1592 lib1593 lib1594 lib1596 \
          lib1905 lib1906 lib1907 lib1908 lib1910 lib1911 lib1912 lib1913 \
          lib1915 lib1916 lib1917 lib1918 lib1933 lib1934 lib1935 lib1936 \
 + lib1948 \
          lib3010
 chkdecimalpoint_SOURCES = chkdecimalpoint.c ../../lib/mprintf.c \
@@ -690,6 +691,10 @@ lib1936_SOURCES = lib1936.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
 lib1936_LDADD = $(TESTUTIL_LIBS)
 lib1936_CPPFLAGS = $(AM_CPPFLAGS)
 +lib1948_SOURCES = lib1948.c $(SUPPORTFILES)
 +lib1948_LDADD = $(TESTUTIL_LIBS)
 +lib1948_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1948
 +
 lib3010_SOURCES = lib3010.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
 lib3010_LDADD = $(TESTUTIL_LIBS)
 lib3010_CPPFLAGS = $(AM_CPPFLAGS)
 diff --git a/tests/libtest/lib1948.c b/tests/libtest/lib1948.c
 new file mode 100644
 index 0000000..7c891a2
 --- /dev/null
 +++ b/tests/libtest/lib1948.c
@@ -0,0 +1,79 @@
 +/***************************************************************************
 + *                                  _   _ ____  _
 + *  Project                     ___| | | |  _ \| |
 + *                             / __| | | | |_) | |
 + *                            | (__| |_| |  _ <| |___
 + *                             \___|\___/|_| \_\_____|
 + *
 + * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
 + *
 + * This software is licensed as described in the file COPYING, which
 + * you should have received as part of this distribution. The terms
 + * are also available at https://curl.haxx.se/docs/copyright.html.
 + *
 + * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 + * copies of the Software, and permit persons to whom the Software is
 + * furnished to do so, under the terms of the COPYING file.
 + *
 + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
 + * KIND, either express or implied.
 + *
 + * SPDX-License-Identifier: curl
 + *
 + ***************************************************************************/
 +
 +#include "test.h"
 +
 +typedef struct
 +{
 +  char *buf;
 +  size_t len;
 +} put_buffer;
 +
 +static size_t put_callback(char *ptr, size_t size, size_t nmemb, void *stream)
 +{
 +  put_buffer *putdata = (put_buffer *)stream;
 +  size_t totalsize = size * nmemb;
 +  size_t tocopy = (putdata->len < totalsize) ? putdata->len : totalsize;
 +  memcpy(ptr, putdata->buf, tocopy);
 +  putdata->len -= tocopy;
 +  putdata->buf += tocopy;
 +  return tocopy;
 +}
 +
 +int test(char *URL)
 +{
 +  CURL *curl;
 +  CURLcode res = CURLE_OUT_OF_MEMORY;
 +
 +  curl_global_init(CURL_GLOBAL_DEFAULT);
 +
 +  curl = curl_easy_init();
 +  if(curl) {
 +    const char *testput = "This is test PUT data\n";
 +    put_buffer pbuf;
 +
 +    /* PUT */
 +    curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
 +    curl_easy_setopt(curl, CURLOPT_HEADER, 1L);
 +    curl_easy_setopt(curl, CURLOPT_READFUNCTION, put_callback);
 +    pbuf.buf = (char *)testput;
 +    pbuf.len = strlen(testput);
 +    curl_easy_setopt(curl, CURLOPT_READDATA, &pbuf);
 +    curl_easy_setopt(curl, CURLOPT_INFILESIZE, (long)strlen(testput));
 +    res = curl_easy_setopt(curl, CURLOPT_URL, URL);
 +    if(!res)
 +      res = curl_easy_perform(curl);
 +    if(!res) {
 +      /* POST */
 +      curl_easy_setopt(curl, CURLOPT_POST, 1L);
 +      curl_easy_setopt(curl, CURLOPT_POSTFIELDS, testput);
 +      curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(testput));
 +      res = curl_easy_perform(curl);
 +    }
 +    curl_easy_cleanup(curl);
 +  }
 +
 +  curl_global_cleanup();
 +  return (int)res;
 +}
 -- 
 2.37.3
--- a/SOURCES/0023-curl-7.61.1-no-https-proxy-crash.patch
+++ b/SOURCES/0023-curl-7.61.1-no-https-proxy-crash.patch
@ -0,0 +1,60 @@
 From 9d5903ebcbcbcc4f3a997ec7d5552721c5383b9f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Martin=20Ba=C5=A1ti?= <mbasti@redhat.com>
 Date: Thu, 27 Aug 2020 23:09:56 +0200
 Subject: [PATCH] http_proxy: do not crash with HTTPS_PROXY and NO_PROXY set
 ... in case NO_PROXY takes an effect
 Without this patch, the following command crashes:
    $ GIT_CURL_VERBOSE=1 NO_PROXY=github.com HTTPS_PROXY=https://example.com \
        git clone https://github.com/curl/curl.git
 Minimal libcurl-based reproducer:
    #include <curl/curl.h>
    int main() {
      CURL *curl = curl_easy_init();
      if(curl) {
        CURLcode ret;
        curl_easy_setopt(curl, CURLOPT_URL, "https://github.com/");
        curl_easy_setopt(curl, CURLOPT_PROXY, "example.com");
        /* set the proxy type */
        curl_easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_HTTPS);
        curl_easy_setopt(curl, CURLOPT_NOPROXY, "github.com");
        curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
        ret = curl_easy_perform(curl);
        curl_easy_cleanup(curl);
        return ret;
      }
      return -1;
    }
 Assisted-by: Kamil Dudka
 Bug: https://bugzilla.redhat.com/1873327
 Closes #5902
 Upstream-commit: 3eff1c5092e542819ac7e6454a70c94b36ab2a40
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/url.c | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/lib/url.c b/lib/url.c
 index d65d17d..e77f391 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -3074,6 +3074,9 @@ static CURLcode create_conn_helper_init_proxy(struct connectdata *conn)
     conn->bits.socksproxy = FALSE;
     conn->bits.proxy_user_passwd = FALSE;
     conn->bits.tunnel_proxy = FALSE;
 +    /* CURLPROXY_HTTPS does not have its own flag in conn->bits, yet we need
 +       to signal that CURLPROXY_HTTPS is not used for this connection */
 +    conn->http_proxy.proxytype = CURLPROXY_HTTP;
   }
 out:
 -- 
 2.25.4
--- a/SOURCES/0024-curl-7.61.1-openssl-partial-chain.patch
+++ b/SOURCES/0024-curl-7.61.1-openssl-partial-chain.patch
@ -0,0 +1,291 @@
 From 673adb0a7a21ca3a877ee03dc9e197d5be15a9d3 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 2 Dec 2019 10:45:55 +0100
 Subject: [PATCH 1/3] openssl: set X509_V_FLAG_PARTIAL_CHAIN
 Have intermediate certificates in the trust store be treated as
 trust-anchors, in the same way as self-signed root CA certificates
 are. This allows users to verify servers using the intermediate cert
 only, instead of needing the whole chain.
 Other TLS backends already accept partial chains.
 Reported-by: Jeffrey Walton
 Bug: https://curl.haxx.se/mail/lib-2019-11/0094.html
 Upstream-commit: 94f1f771586913addf5c68f9219e176036c50115
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/vtls/openssl.c | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)
 diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
 index d8bcc4f..8e791b9 100644
 --- a/lib/vtls/openssl.c
 +++ b/lib/vtls/openssl.c
@@ -2551,19 +2551,27 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
     infof(data, "  CRLfile: %s\n", ssl_crlfile);
   }
 -  /* Try building a chain using issuers in the trusted store first to avoid
 -  problems with server-sent legacy intermediates.
 -  Newer versions of OpenSSL do alternate chain checking by default which
 -  gives us the same fix without as much of a performance hit (slight), so we
 -  prefer that if available.
 -  https://rt.openssl.org/Ticket/Display.html?id=3621&user=guest&pass=guest
 -  */
 -#if defined(X509_V_FLAG_TRUSTED_FIRST) && !defined(X509_V_FLAG_NO_ALT_CHAINS)
   if(verifypeer) {
 +    /* Try building a chain using issuers in the trusted store first to avoid
 +       problems with server-sent legacy intermediates.  Newer versions of
 +       OpenSSL do alternate chain checking by default which gives us the same
 +       fix without as much of a performance hit (slight), so we prefer that if
 +       available.
 +       https://rt.openssl.org/Ticket/Display.html?id=3621&user=guest&pass=guest
 +    */
 +#if defined(X509_V_FLAG_TRUSTED_FIRST) && !defined(X509_V_FLAG_NO_ALT_CHAINS)
     X509_STORE_set_flags(SSL_CTX_get_cert_store(BACKEND->ctx),
                          X509_V_FLAG_TRUSTED_FIRST);
 -  }
 #endif
 +#ifdef X509_V_FLAG_PARTIAL_CHAIN
 +    /* Have intermediate certificates in the trust store be treated as
 +       trust-anchors, in the same way as self-signed root CA certificates
 +       are. This allows users to verify servers using the intermediate cert
 +       only, instead of needing the whole chain. */
 +    X509_STORE_set_flags(SSL_CTX_get_cert_store(BACKEND->ctx),
 +                         X509_V_FLAG_PARTIAL_CHAIN);
 +#endif
 +  }
   /* SSL always tries to verify the peer, this only says whether it should
    * fail to connect if the verification fails, or if it should continue
 -- 
 2.26.2
 From b2e6e39b60e1722aecf250ff79a69867df5d3aa8 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 2 Dec 2019 10:55:33 +0100
 Subject: [PATCH 2/3] openssl: CURLSSLOPT_NO_PARTIALCHAIN can disable partial
 cert chains
 Closes #4655
 Upstream-commit: 564d88a8bd190a21b362d6da535fccf74d33394d
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 docs/libcurl/opts/CURLOPT_SSL_OPTIONS.3 | 40 +++++++++++++------------
 docs/libcurl/symbols-in-versions        |  1 +
 include/curl/curl.h                     |  4 +++
 lib/setopt.c                            |  1 +
 lib/urldata.h                           |  1 +
 lib/vtls/openssl.c                      | 14 +++++----
 6 files changed, 36 insertions(+), 25 deletions(-)
 diff --git a/docs/libcurl/opts/CURLOPT_SSL_OPTIONS.3 b/docs/libcurl/opts/CURLOPT_SSL_OPTIONS.3
 index d781434..6286a64 100644
 --- a/docs/libcurl/opts/CURLOPT_SSL_OPTIONS.3
 +++ b/docs/libcurl/opts/CURLOPT_SSL_OPTIONS.3
@@ -29,25 +29,27 @@ CURLOPT_SSL_OPTIONS \- set SSL behavior options
 CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_OPTIONS, long bitmask);
 .SH DESCRIPTION
 -Pass a long with a bitmask to tell libcurl about specific SSL behaviors.
 -
 -\fICURLSSLOPT_ALLOW_BEAST\fP tells libcurl to not attempt to use any
 -workarounds for a security flaw in the SSL3 and TLS1.0 protocols.  If this
 -option isn't used or this bit is set to 0, the SSL layer libcurl uses may use a
 -work-around for this flaw although it might cause interoperability problems
 -with some (older) SSL implementations. WARNING: avoiding this work-around
 -lessens the security, and by setting this option to 1 you ask for exactly that.
 -This option is only supported for DarwinSSL, NSS and OpenSSL.
 -
 -Added in 7.44.0:
 -
 -\fICURLSSLOPT_NO_REVOKE\fP tells libcurl to disable certificate revocation
 -checks for those SSL backends where such behavior is present. \fBCurrently this
 -option is only supported for WinSSL (the native Windows SSL library), with an
 -exception in the case of Windows' Untrusted Publishers blacklist which it seems
 -can't be bypassed.\fP This option may have broader support to accommodate other
 -SSL backends in the future.
 -https://curl.haxx.se/docs/ssl-compared.html
 +Pass a long with a bitmask to tell libcurl about specific SSL
 +behaviors. Available bits:
 +.IP CURLSSLOPT_ALLOW_BEAST
 +Tells libcurl to not attempt to use any workarounds for a security flaw in the
 +SSL3 and TLS1.0 protocols.  If this option isn't used or this bit is set to 0,
 +the SSL layer libcurl uses may use a work-around for this flaw although it
 +might cause interoperability problems with some (older) SSL
 +implementations. WARNING: avoiding this work-around lessens the security, and
 +by setting this option to 1 you ask for exactly that.  This option is only
 +supported for DarwinSSL, NSS and OpenSSL.
 +.IP CURLSSLOPT_NO_REVOKE
 +Tells libcurl to disable certificate revocation checks for those SSL backends
 +where such behavior is present. This option is only supported for Schannel
 +(the native Windows SSL library), with an exception in the case of Windows'
 +Untrusted Publishers blacklist which it seems can't be bypassed. (Added in
 +7.44.0)
 +.IP CURLSSLOPT_NO_PARTIALCHAIN
 +Tells libcurl to not accept "partial" certificate chains, which it otherwise
 +does by default. This option is only supported for OpenSSL and will fail the
 +certificate verification if the chain ends with an intermediate certificate
 +and not with a root cert. (Added in 7.68.0)
 .SH DEFAULT
 0
 .SH PROTOCOLS
 diff --git a/docs/libcurl/symbols-in-versions b/docs/libcurl/symbols-in-versions
 index 3b3861f..54923d0 100644
 --- a/docs/libcurl/symbols-in-versions
 +++ b/docs/libcurl/symbols-in-versions
@@ -713,6 +713,7 @@ CURLSSLBACKEND_QSOSSL           7.34.0        -           7.38.1
 CURLSSLBACKEND_SCHANNEL         7.34.0
 CURLSSLBACKEND_WOLFSSL          7.49.0
 CURLSSLOPT_ALLOW_BEAST          7.25.0
 +CURLSSLOPT_NO_PARTIALCHAIN      7.68.0
 CURLSSLOPT_NO_REVOKE            7.44.0
 CURLSSLSET_NO_BACKENDS          7.56.0
 CURLSSLSET_OK                   7.56.0
 diff --git a/include/curl/curl.h b/include/curl/curl.h
 index 8f473e2..75f9384 100644
 --- a/include/curl/curl.h
 +++ b/include/curl/curl.h
@@ -795,6 +795,10 @@ typedef enum {
    SSL backends where such behavior is present. */
 #define CURLSSLOPT_NO_REVOKE (1<<1)
 +/* - NO_PARTIALCHAIN tells libcurl to *NOT* accept a partial certificate chain
 +   if possible. The OpenSSL backend has this ability. */
 +#define CURLSSLOPT_NO_PARTIALCHAIN (1<<2)
 +
 /* The default connection attempt delay in milliseconds for happy eyeballs.
    CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.3 and happy-eyeballs-timeout-ms.d document
    this value, keep them in sync. */
 diff --git a/lib/setopt.c b/lib/setopt.c
 index 5c5f4b3..4f04962 100644
 --- a/lib/setopt.c
 +++ b/lib/setopt.c
@@ -2046,6 +2046,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
     arg = va_arg(param, long);
     data->set.ssl.enable_beast = arg&CURLSSLOPT_ALLOW_BEAST?TRUE:FALSE;
     data->set.ssl.no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE);
 +    data->set.ssl.no_partialchain = !!(arg & CURLSSLOPT_NO_PARTIALCHAIN);
     break;
   case CURLOPT_PROXY_SSL_OPTIONS:
 diff --git a/lib/urldata.h b/lib/urldata.h
 index 4b70cc5..c70290a 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -235,6 +235,7 @@ struct ssl_config_data {
   bool enable_beast; /* especially allow this flaw for interoperability's
                         sake*/
   bool no_revoke;    /* disable SSL certificate revocation checks */
 +  bool no_partialchain;  /* don't accept partial certificate chains */
   long certverifyresult; /* result from the certificate verification */
   char *CRLfile;   /* CRL to check certificate revocation */
   char *issuercert;/* optional issuer certificate filename */
 diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
 index 8e791b9..87f6c4c 100644
 --- a/lib/vtls/openssl.c
 +++ b/lib/vtls/openssl.c
@@ -2564,12 +2564,14 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
                          X509_V_FLAG_TRUSTED_FIRST);
 #endif
 #ifdef X509_V_FLAG_PARTIAL_CHAIN
 -    /* Have intermediate certificates in the trust store be treated as
 -       trust-anchors, in the same way as self-signed root CA certificates
 -       are. This allows users to verify servers using the intermediate cert
 -       only, instead of needing the whole chain. */
 -    X509_STORE_set_flags(SSL_CTX_get_cert_store(BACKEND->ctx),
 -                         X509_V_FLAG_PARTIAL_CHAIN);
 +    if(!SSL_SET_OPTION(no_partialchain)) {
 +      /* Have intermediate certificates in the trust store be treated as
 +         trust-anchors, in the same way as self-signed root CA certificates
 +         are. This allows users to verify servers using the intermediate cert
 +         only, instead of needing the whole chain. */
 +      X509_STORE_set_flags(SSL_CTX_get_cert_store(BACKEND->ctx),
 +                           X509_V_FLAG_PARTIAL_CHAIN);
 +    }
 #endif
   }
 -- 
 2.26.2
 From d149ba12f302e5275b408d82ffb349eac16b9226 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 11 May 2020 23:00:31 +0200
 Subject: [PATCH 3/3] OpenSSL: have CURLOPT_CRLFILE imply
 CURLSSLOPT_NO_PARTIALCHAIN
 ... to avoid an OpenSSL bug that otherwise makes the CRL check to fail.
 Reported-by: Michael Kaufmann
 Fixes #5374
 Closes #5376
 Upstream-commit: 81a54b12c631e8126e3eb484c74040b991e78f0c
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 docs/libcurl/opts/CURLOPT_CRLFILE.3 | 13 ++++++++-----
 lib/vtls/openssl.c                  |  8 ++++++--
 2 files changed, 14 insertions(+), 7 deletions(-)
 diff --git a/docs/libcurl/opts/CURLOPT_CRLFILE.3 b/docs/libcurl/opts/CURLOPT_CRLFILE.3
 index 080caa7..f111585 100644
 --- a/docs/libcurl/opts/CURLOPT_CRLFILE.3
 +++ b/docs/libcurl/opts/CURLOPT_CRLFILE.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
 -.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
 +.\" * Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -34,10 +34,13 @@ concatenation of CRL (in PEM format) to use in the certificate validation that
 occurs during the SSL exchange.
 When curl is built to use NSS or GnuTLS, there is no way to influence the use
 -of CRL passed to help in the verification process. When libcurl is built with
 -OpenSSL support, X509_V_FLAG_CRL_CHECK and X509_V_FLAG_CRL_CHECK_ALL are both
 -set, requiring CRL check against all the elements of the certificate chain if
 -a CRL file is passed.
 +of CRL passed to help in the verification process.
 +
 +When libcurl is built with OpenSSL support, X509_V_FLAG_CRL_CHECK and
 +X509_V_FLAG_CRL_CHECK_ALL are both set, requiring CRL check against all the
 +elements of the certificate chain if a CRL file is passed. Also note that
 +\fICURLOPT_CRLFILE(3)\fP will imply \fBCURLSSLOPT_NO_PARTIALCHAIN\fP (see
 +\fICURLOPT_SSL_OPTIONS(3)\fP) since curl 7.71.0 due to an OpenSSL bug.
 This option makes sense only when used in combination with the
 \fICURLOPT_SSL_VERIFYPEER(3)\fP option.
 diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
 index 87f6c4c..9476773 100644
 --- a/lib/vtls/openssl.c
 +++ b/lib/vtls/openssl.c
@@ -2564,11 +2564,15 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
                          X509_V_FLAG_TRUSTED_FIRST);
 #endif
 #ifdef X509_V_FLAG_PARTIAL_CHAIN
 -    if(!SSL_SET_OPTION(no_partialchain)) {
 +    if(!SSL_SET_OPTION(no_partialchain) && !ssl_crlfile) {
       /* Have intermediate certificates in the trust store be treated as
          trust-anchors, in the same way as self-signed root CA certificates
          are. This allows users to verify servers using the intermediate cert
 -         only, instead of needing the whole chain. */
 +         only, instead of needing the whole chain.
 +
 +         Due to OpenSSL bug https://github.com/openssl/openssl/issues/5081 we
 +         cannot do partial chains with CRL check.
 +      */
       X509_STORE_set_flags(SSL_CTX_get_cert_store(BACKEND->ctx),
                            X509_V_FLAG_PARTIAL_CHAIN);
     }
 -- 
 2.26.2
--- a/SOURCES/0024-curl-7.76.1-CVE-2023-23916.patch
+++ b/SOURCES/0024-curl-7.76.1-CVE-2023-23916.patch
@ -1,678 +0,0 @@
 From 95f873ff983a1ae57415b3c16a881e74432cf8b8 Mon Sep 17 00:00:00 2001
 From: Fabian Keil <fk@fabiankeil.de>
 Date: Tue, 9 Feb 2021 14:04:32 +0100
 Subject: [PATCH 1/4] runtests.pl: support the nonewline attribute for the data
 part
 Added to FILEFORMAT
 Closes #8239
 Upstream-commit: 736847611a40c01e7c290407e22e2f0f5f8efd6a
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/FILEFORMAT.md    |  5 ++++-
 tests/runtests.pl      |  7 +++++++
 tests/server/getpart.c | 11 ++++++++++-
 3 files changed, 21 insertions(+), 2 deletions(-)
 diff --git a/tests/FILEFORMAT.md b/tests/FILEFORMAT.md
 index b75a02a..0b98787 100644
 --- a/tests/FILEFORMAT.md
 +++ b/tests/FILEFORMAT.md
@@ -185,7 +185,7 @@ which are treated together as a single identifier.
 ## `<reply>`
 -### `<data [nocheck="yes"] [sendzero="yes"] [base64="yes"] [hex="yes"]>`
 +### `<data [nocheck="yes"] [sendzero="yes"] [base64="yes"] [hex="yes"] [nonewline="yes"]>`
 data to be sent to the client on its request and later verified that it
 arrived safely. Set `nocheck="yes"` to prevent the test script from verifying
@@ -211,6 +211,9 @@ much sense for other sections than "data").
 `hex=yes` means that the data is a sequence of hex pairs. It will get decoded
 and used as "raw" data.
 +`nonewline=yes` means that the last byte (the trailing newline character)
 +should be cut off from the data before sending or comparing it.
 +
 For FTP file listings, the `<data>` section will be used *only* if you make
 sure that there has been a CWD done first to a directory named `test-[num]`
 where [num] is the test case number. Otherwise the ftp server can't know from
 diff --git a/tests/runtests.pl b/tests/runtests.pl
 index 40315aa..2e1500d 100755
 --- a/tests/runtests.pl
 +++ b/tests/runtests.pl
@@ -3837,6 +3837,13 @@ sub singletest {
     else {
         # check against the data section
         @reply = getpart("reply", "data");
 +        if(@reply) {
 +            my %hash = getpartattr("reply", "data");
 +            if($hash{'nonewline'}) {
 +                # cut off the final newline from the final line of the data
 +                chomp($reply[$#reply]);
 +            }
 +        }
         # get the mode attribute
         my $filemode=$replyattr{'mode'};
         if($filemode && ($filemode eq "text") && $has_textaware) {
 diff --git a/tests/server/getpart.c b/tests/server/getpart.c
 index 32b55bc..f8fe3f6 100644
 --- a/tests/server/getpart.c
 +++ b/tests/server/getpart.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
 - * Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al.
 + * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -295,6 +295,7 @@ int getpart(char **outbuf, size_t *outlen,
   size_t outalloc = 256;
   int in_wanted_part = 0;
   int base64 = 0;
 +  int nonewline = 0;
   int error;
   enum {
@@ -360,6 +361,8 @@ int getpart(char **outbuf, size_t *outlen,
             if(error)
               return error;
           }
 +          if(nonewline)
 +            (*outlen)--;
           break;
         }
       }
@@ -377,6 +380,8 @@ int getpart(char **outbuf, size_t *outlen,
             if(error)
               return error;
           }
 +          if(nonewline)
 +            (*outlen)--;
           break;
         }
       }
@@ -451,6 +456,10 @@ int getpart(char **outbuf, size_t *outlen,
               /* bit rough test, but "mostly" functional, */
               /* treat wanted part data as base64 encoded */
               base64 = 1;
 +          if(strstr(patt, "nonewline=")) {
 +            show(("* setting nonewline\n"));
 +            nonewline = 1;
 +          }
         }
         continue;
       }
 -- 
 2.39.1
 From 6e244e1bcb04012e11c537253e76e6f968d8bb72 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 1 Dec 2022 09:21:04 +0100
 Subject: [PATCH 2/4] runtests: do CRLF replacements per section only
 The `crlf="yes"` attribute and "hyper mode" are now only applied on a
 subset of dedicated sections: data, datacheck, stdout and protocol.
 Updated test 2500 accordingly.
 Also made test1 use crlf="yes" for <protocol>, mostly because it is
 often used as a template test case. Going forward, using this attribute
 we should be able to write test cases using linefeeds only and avoid
 mixed line ending encodings.
 Follow-up to ca15b7512e8d11
 Fixes #10009
 Closes #10010
 Upstream-commit: 2f34a7347f315513bfda9ef14770d287fb246bcd
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/FILEFORMAT.md | 22 +++++++++++++++------
 tests/data/test1    | 14 ++++++-------
 tests/runtests.pl   | 48 ++++++++++++++++++++++++++++++++++++++++++---
 3 files changed, 68 insertions(+), 16 deletions(-)
 diff --git a/tests/FILEFORMAT.md b/tests/FILEFORMAT.md
 index c1fbc57..dcb5695 100644
 --- a/tests/FILEFORMAT.md
 +++ b/tests/FILEFORMAT.md
@@ -185,7 +185,7 @@ which are treated together as a single identifier.
 ## `<reply>`
 -### `<data [nocheck="yes"] [sendzero="yes"] [base64="yes"] [hex="yes"] [nonewline="yes"]>`
 +### `<data [nocheck="yes"] [sendzero="yes"] [base64="yes"] [hex="yes"] [nonewline="yes"] [crlf="yes"]>`
 data to be sent to the client on its request and later verified that it
 arrived safely. Set `nocheck="yes"` to prevent the test script from verifying
@@ -214,12 +214,16 @@ and used as "raw" data.
 `nonewline=yes` means that the last byte (the trailing newline character)
 should be cut off from the data before sending or comparing it.
 +`crlf=yes` forces *header* newlines to become CRLF even if not written so in
 +the source file. Note that this makes runtests.pl parse and "guess" what is a
 +header and what is not in order to apply the CRLF line endings appropriately.
 +
 For FTP file listings, the `<data>` section will be used *only* if you make
 sure that there has been a CWD done first to a directory named `test-[num]`
 where [num] is the test case number. Otherwise the ftp server can't know from
 which test file to load the list content.
 -### `<dataNUM>`
 +### `<dataNUM [crlf="yes"]>`
 Send back this contents instead of the <data> one. The num is set by:
@@ -243,7 +247,7 @@ The connect section is used instead of the 'data' for all CONNECT
 requests. The remainder of the rules for the data section then apply but with
 a connect prefix.
 -### `<datacheck [mode="text"] [nonewline="yes"]>`
 +### `<datacheck [mode="text"] [nonewline="yes"] [crlf="yes"]>`
 if the data is sent but this is what should be checked afterwards. If
 `nonewline=yes` is set, runtests will cut off the trailing newline from the
 data before comparing with the one actually received by the client.
@@ -251,7 +255,7 @@ data before comparing with the one actually received by the client.
 Use the `mode="text"` attribute if the output is in text mode on platforms
 that have a text/binary difference.
 -### `<datacheckNUM [nonewline="yes"] [mode="text"]>`
 +### `<datacheckNUM [nonewline="yes"] [mode="text"] [crlf="yes"]>`
 The contents of numbered datacheck sections are appended to the non-numbered
 one.
@@ -528,13 +532,16 @@ changing protocol data such as port numbers or user-agent strings.
 One perl op per line that operates on the protocol dump. This is pretty
 advanced. Example: `s/^EPRT .*/EPRT stripped/`.
 -### `<protocol [nonewline="yes"]>`
 +### `<protocol [nonewline="yes"] crlf="yes">`
 the protocol dump curl should transmit, if 'nonewline' is set, we will cut off
 the trailing newline of this given data before comparing with the one actually
 sent by the client The `<strip>` and `<strippart>` rules are applied before
 comparisons are made.
 +`crlf=yes` forces the newlines to become CRLF even if not written so in the
 +test.
 +
 ### `<proxy [nonewline="yes"]>`
 The protocol dump curl should transmit to a HTTP proxy (when the http-proxy
@@ -551,7 +558,7 @@ have a text/binary difference.
 If 'nonewline' is set, we will cut off the trailing newline of this given data
 before comparing with the one actually received by the client
 -### `<stdout [mode="text"] [nonewline="yes"]>`
 +### `<stdout [mode="text"] [nonewline="yes"] [crlf="yes"]>`
 This verifies that this data was passed to stdout.
 Use the mode="text" attribute if the output is in text mode on platforms that
@@ -560,6 +567,9 @@ have a text/binary difference.
 If 'nonewline' is set, we will cut off the trailing newline of this given data
 before comparing with the one actually received by the client
 +`crlf=yes` forces the newlines to become CRLF even if not written so in the
 +test.
 +
 ### `<file name="log/filename" [mode="text"]>`
 The file's contents must be identical to this after the test is complete.  Use
 the mode="text" attribute if the output is in text mode on platforms that have
 diff --git a/tests/data/test1 b/tests/data/test1
 index f39a08b..700bed8 100644
 --- a/tests/data/test1
 +++ b/tests/data/test1
@@ -9,7 +9,7 @@ HTTP GET
 #
 # Server-side
 <reply>
 -<data>
 +<data crlf="yes">
 HTTP/1.1 200 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -42,12 +42,12 @@ http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 #
 # Verify data after the test has been "shot"
 <verify>
 -<protocol>
 -GET /%TESTNUMBER HTTP/1.1
 -Host: %HOSTIP:%HTTPPORT
 -User-Agent: curl/%VERSION
 -Accept: */*
 -
 +<protocol crlf="yes">
 +GET /%TESTNUMBER HTTP/1.1
 +Host: %HOSTIP:%HTTPPORT
 +User-Agent: curl/%VERSION
 +Accept: */*
 +
 </protocol>
 </verify>
 </testcase>
 diff --git a/tests/runtests.pl b/tests/runtests.pl
 index 72a9989..b12a42d 100755
 --- a/tests/runtests.pl
 +++ b/tests/runtests.pl
@@ -3410,7 +3410,13 @@ sub subBase64 {
 my $prevupdate;
 sub subNewlines {
 -    my ($thing) = @_;
 +    my ($force, $thing) = @_;
 +
 +    if($force) {
 +        # enforce CRLF newline
 +        $$thing =~ s/\x0d*\x0a/\x0d\x0a/;
 +        return;
 +    }
     # When curl is built with Hyper, it gets all response headers delivered as
     # name/value pairs and curl "invents" the newlines when it saves the
@@ -3424,7 +3430,7 @@ sub subNewlines {
         # skip curl error messages
         ($$thing !~ /^curl: \(\d+\) /))) {
         # enforce CRLF newline
 -        $$thing =~ s/\x0a/\x0d\x0a/;
 +        $$thing =~ s/\x0d*\x0a/\x0d\x0a/;
         $prevupdate = 1;
     }
     else {
@@ -3496,6 +3502,7 @@ sub prepro {
     my (@entiretest) = @_;
     my $show = 1;
     my @out;
 +    my $data_crlf;
     for my $s (@entiretest) {
         my $f = $s;
         if($s =~ /^ *%if (.*)/) {
@@ -3519,9 +3526,19 @@ sub prepro {
             next;
         }
         if($show) {
 +            # The processor does CRLF replacements in the <data*> sections if
 +            # necessary since those parts might be read by separate servers.
 +            if($s =~ /^ *<data(.*)\>/) {
 +                if($1 =~ /crlf="yes"/ || $has_hyper) {
 +                    $data_crlf = 1;
 +                }
 +            }
 +            elsif(($s =~ /^ *<\/data/) && $data_crlf) {
 +                $data_crlf = 0;
 +            }
             subVariables(\$s, $testnum, "%");
             subBase64(\$s);
 -            subNewlines(\$s) if($has_hyper);
 +            subNewlines(0, \$s) if($data_crlf);
             push @out, $s;
         }
     }
@@ -3830,6 +3847,11 @@ sub singletest {
                     # of the datacheck
                     chomp($replycheckpart[$#replycheckpart]);
                 }
 +                if($replycheckpartattr{'crlf'} ||
 +                   ($has_hyper && ($keywords{"HTTP"}
 +                                   || $keywords{"HTTPS"}))) {
 +                    map subNewlines(0, \$_), @replycheckpart;
 +                }
                 push(@reply, @replycheckpart);
             }
         }
@@ -3851,6 +3873,11 @@ sub singletest {
             map s/\r\n/\n/g, @reply;
             map s/\n/\r\n/g, @reply;
         }
 +        if($replyattr{'crlf'} ||
 +           ($has_hyper && ($keywords{"HTTP"}
 +                           || $keywords{"HTTPS"}))) {
 +            map subNewlines(0, \$_), @reply;
 +        }
     }
     # this is the valid protocol blurb curl should generate
@@ -4287,6 +4314,12 @@ sub singletest {
             chomp($validstdout[$#validstdout]);
         }
 +        if($hash{'crlf'} ||
 +           ($has_hyper && ($keywords{"HTTP"}
 +                           || $keywords{"HTTPS"}))) {
 +            map subNewlines(0, \$_), @validstdout;
 +        }
 +
         $res = compare($testnum, $testname, "stdout", \@actual, \@validstdout);
         if($res) {
             return $errorreturncode;
@@ -4381,6 +4414,10 @@ sub singletest {
             }
         }
 +        if($hash{'crlf'}) {
 +            map subNewlines(1, \$_), @protstrip;
 +        }
 +
         if((!$out[0] || ($out[0] eq "")) && $protstrip[0]) {
             logmsg "\n $testnum: protocol FAILED!\n".
                 " There was no content at all in the file $SERVERIN.\n".
@@ -4512,6 +4549,11 @@ sub singletest {
                 map s/\r\n/\n/g, @outfile;
                 map s/\n/\r\n/g, @outfile;
             }
 +            if($hash{'crlf'} ||
 +               ($has_hyper && ($keywords{"HTTP"}
 +                               || $keywords{"HTTPS"}))) {
 +                map subNewlines(0, \$_), @outfile;
 +            }
             my $strip;
             for $strip (@stripfile) {
 -- 
 2.39.1
 From 228ed11bf33c63d9208a3fb38fe5a0d19c0764bd Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Tue, 27 Dec 2022 11:50:23 +0100
 Subject: [PATCH 3/4] runtests: support crlf="yes" for verify/proxy
 Upstream-commit: dc0725244a3163f1e2d5f51165db3a1a430f3ba0
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/FILEFORMAT.md | 4 ++--
 tests/runtests.pl   | 5 +++++
 2 files changed, 7 insertions(+), 2 deletions(-)
 diff --git a/tests/FILEFORMAT.md b/tests/FILEFORMAT.md
 index dcb5695..6646793 100644
 --- a/tests/FILEFORMAT.md
 +++ b/tests/FILEFORMAT.md
@@ -532,7 +532,7 @@ changing protocol data such as port numbers or user-agent strings.
 One perl op per line that operates on the protocol dump. This is pretty
 advanced. Example: `s/^EPRT .*/EPRT stripped/`.
 -### `<protocol [nonewline="yes"] crlf="yes">`
 +### `<protocol [nonewline="yes"][crlf="yes"]>`
 the protocol dump curl should transmit, if 'nonewline' is set, we will cut off
 the trailing newline of this given data before comparing with the one actually
@@ -542,7 +542,7 @@ comparisons are made.
 `crlf=yes` forces the newlines to become CRLF even if not written so in the
 test.
 -### `<proxy [nonewline="yes"]>`
 +### `<proxy [nonewline="yes"][crlf="yes"]>`
 The protocol dump curl should transmit to a HTTP proxy (when the http-proxy
 server is used), if 'nonewline' is set, we will cut off the trailing newline
 diff --git a/tests/runtests.pl b/tests/runtests.pl
 index b12a42d..5cdc83d 100755
 --- a/tests/runtests.pl
 +++ b/tests/runtests.pl
@@ -4510,6 +4510,11 @@ sub singletest {
             }
         }
 +        if($hash{'crlf'} ||
 +           ($has_hyper && ($keywords{"HTTP"} || $keywords{"HTTPS"}))) {
 +            map subNewlines(0, \$_), @protstrip;
 +        }
 +
         $res = compare($testnum, $testname, "proxy", \@out, \@protstrip);
         if($res) {
             return $errorreturncode;
 -- 
 2.39.1
 From bc5fc958b017895728962c9d44c469418cbec1a0 Mon Sep 17 00:00:00 2001
 From: Patrick Monnerat <patrick@monnerat.net>
 Date: Mon, 13 Feb 2023 08:33:09 +0100
 Subject: [PATCH 4/4] content_encoding: do not reset stage counter for each
 header
 Test 418 verifies
 Closes #10492
 Upstream-commit: 119fb187192a9ea13dc90d9d20c215fc82799ab9
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/content_encoding.c  |   7 +-
 lib/urldata.h           |   1 +
 tests/data/Makefile.inc |   1 +
 tests/data/test387      |   2 +-
 tests/data/test418      | 152 ++++++++++++++++++++++++++++++++++++++++
 5 files changed, 158 insertions(+), 5 deletions(-)
 create mode 100644 tests/data/test418
 diff --git a/lib/content_encoding.c b/lib/content_encoding.c
 index bfc13e2..94344d6 100644
 --- a/lib/content_encoding.c
 +++ b/lib/content_encoding.c
@@ -1033,7 +1033,6 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
                                      const char *enclist, int maybechunked)
 {
   struct SingleRequest *k = &data->req;
 -  int counter = 0;
   do {
     const char *name;
@@ -1068,9 +1067,9 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
       if(!encoding)
         encoding = &error_encoding;  /* Defer error at stack use. */
 -      if(++counter >= MAX_ENCODE_STACK) {
 -        failf(data, "Reject response due to %u content encodings",
 -              counter);
 +      if(k->writer_stack_depth++ >= MAX_ENCODE_STACK) {
 +        failf(data, "Reject response due to more than %u content encodings",
 +              MAX_ENCODE_STACK);
         return CURLE_BAD_CONTENT_ENCODING;
       }
       /* Stack the unencoding stage. */
 diff --git a/lib/urldata.h b/lib/urldata.h
 index 5b4b34f..8c8c20b 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -700,6 +700,7 @@ struct SingleRequest {
 #ifndef CURL_DISABLE_DOH
   struct dohdata *doh; /* DoH specific data for this request */
 #endif
 +  unsigned char writer_stack_depth; /* Unencoding stack depth. */
   BIT(header);       /* incoming data has HTTP header */
   BIT(content_range); /* set TRUE if Content-Range: was found */
   BIT(upload_done);  /* set to TRUE when doing chunked transfer-encoding
 diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
 index fb51cd6..86b6f85 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
@@ -67,6 +67,7 @@ test393 test394 test395 test396 test397 \
 \
 test400 test401 test402 test403 test404 test405 test406 test407 test408 \
 test409 test410 \
 +        test418 \
 \
 test430 test431 test432 test433 test434 \
 \
 diff --git a/tests/data/test387 b/tests/data/test387
 index 015ec25..644fc7f 100644
 --- a/tests/data/test387
 +++ b/tests/data/test387
@@ -47,7 +47,7 @@ Accept: */*
 61
 </errorcode>
 <stderr mode="text">
 -curl: (61) Reject response due to 5 content encodings
 +curl: (61) Reject response due to more than 5 content encodings
 </stderr>
 </verify>
 </testcase>
 diff --git a/tests/data/test418 b/tests/data/test418
 new file mode 100644
 index 0000000..50e974e
 --- /dev/null
 +++ b/tests/data/test418
@@ -0,0 +1,152 @@
 +<testcase>
 +<info>
 +<keywords>
 +HTTP
 +gzip
 +</keywords>
 +</info>
 +
 +#
 +# Server-side
 +<reply>
 +<data nocheck="yes">
 +HTTP/1.1 200 OK
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +
 +-foo-
 +</data>
 +</reply>
 +
 +#
 +# Client-side
 +<client>
 +<server>
 +http
 +</server>
 + <name>
 +Response with multiple Transfer-Encoding headers
 + </name>
 + <command>
 +http://%HOSTIP:%HTTPPORT/%TESTNUMBER -sS
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<protocol crlf="yes">
 +GET /%TESTNUMBER HTTP/1.1
 +Host: %HOSTIP:%HTTPPORT
 +User-Agent: curl/%VERSION
 +Accept: */*
 +
 +</protocol>
 +
 +# CURLE_BAD_CONTENT_ENCODING is 61
 +<errorcode>
 +61
 +</errorcode>
 +<stderr mode="text">
 +curl: (61) Reject response due to more than 5 content encodings
 +</stderr>
 +</verify>
 +</testcase>
 -- 
 2.39.1
--- a/SOURCES/0025-curl-7.61.1-CVE-2020-8284.patch
+++ b/SOURCES/0025-curl-7.61.1-CVE-2020-8284.patch
@ -0,0 +1,208 @@
 From 2629f42d4cfdd04df0544007b03161e3d5d52d54 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Tue, 24 Nov 2020 14:56:57 +0100
 Subject: [PATCH] ftp: CURLOPT_FTP_SKIP_PASV_IP by default
 The command line tool also independently sets --ftp-skip-pasv-ip by
 default.
 Ten test cases updated to adapt the modified --libcurl output.
 Bug: https://curl.se/docs/CVE-2020-8284.html
 CVE-2020-8284
 Reported-by: Varnavas Papaioannou
 Upstream-commit: ec9cc725d598ac77de7b6df8afeec292b3c8ad46
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 docs/cmdline-opts/ftp-skip-pasv-ip.d         | 2 ++
 docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3 | 8 +++++---
 lib/url.c                                    | 1 +
 src/tool_cfgable.c                           | 1 +
 tests/data/test1400                          | 1 +
 tests/data/test1401                          | 1 +
 tests/data/test1402                          | 1 +
 tests/data/test1403                          | 1 +
 tests/data/test1404                          | 1 +
 tests/data/test1405                          | 1 +
 tests/data/test1406                          | 1 +
 tests/data/test1407                          | 1 +
 tests/data/test1420                          | 1 +
 13 files changed, 18 insertions(+), 3 deletions(-)
 diff --git a/docs/cmdline-opts/ftp-skip-pasv-ip.d b/docs/cmdline-opts/ftp-skip-pasv-ip.d
 index da6ab11..4be8b43 100644
 --- a/docs/cmdline-opts/ftp-skip-pasv-ip.d
 +++ b/docs/cmdline-opts/ftp-skip-pasv-ip.d
@@ -9,4 +9,6 @@ to curl's PASV command when curl connects the data connection. Instead curl
 will re-use the same IP address it already uses for the control
 connection.
 +Since curl 7.74.0 this option is enabled by default.
 +
 This option has no effect if PORT, EPRT or EPSV is used instead of PASV.
 diff --git a/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3 b/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3
 index 4d3026a..4227ed6 100644
 --- a/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3
 +++ b/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
 -.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
 +.\" * Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -36,11 +36,13 @@ address it already uses for the control connection. But it will use the port
 number from the 227-response.
 This option thus allows libcurl to work around broken server installations
 -that due to NATs, firewalls or incompetence report the wrong IP address back.
 +that due to NATs, firewalls or incompetence report the wrong IP address
 +back. Setting the option also reduces the risk for various sorts of client
 +abuse by malicious servers.
 This option has no effect if PORT, EPRT or EPSV is used instead of PASV.
 .SH DEFAULT
 -0
 +1 since 7.74.0, was 0 before then.
 .SH PROTOCOLS
 FTP
 .SH EXAMPLE
 diff --git a/lib/url.c b/lib/url.c
 index e77f391..b18db25 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -434,6 +434,7 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
   set->ftp_use_eprt = TRUE;   /* FTP defaults to EPRT operations */
   set->ftp_use_pret = FALSE;  /* mainly useful for drftpd servers */
   set->ftp_filemethod = FTPFILE_MULTICWD;
 +  set->ftp_skip_ip = TRUE;    /* skip PASV IP by default */
   set->dns_cache_timeout = 60; /* Timeout every 60 seconds by default */
 diff --git a/src/tool_cfgable.c b/src/tool_cfgable.c
 index 81e16c1..110191e 100644
 --- a/src/tool_cfgable.c
 +++ b/src/tool_cfgable.c
@@ -43,6 +43,7 @@ void config_init(struct OperationConfig* config)
   config->proto_default = NULL;
   config->tcp_nodelay = TRUE; /* enabled by default */
   config->happy_eyeballs_timeout_ms = CURL_HET_DEFAULT;
 +  config->ftp_skip_ip = TRUE;
 }
 static void free_config_fields(struct OperationConfig *config)
 diff --git a/tests/data/test1400 b/tests/data/test1400
 index 10faef3..9d18a30 100644
 --- a/tests/data/test1400
 +++ b/tests/data/test1400
@@ -73,6 +73,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
 +  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
   /* Here is a list of options the curl code used that cannot get generated
 diff --git a/tests/data/test1401 b/tests/data/test1401
 index f330931..99cb0cb 100644
 --- a/tests/data/test1401
 +++ b/tests/data/test1401
@@ -89,6 +89,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
   curl_easy_setopt(hnd, CURLOPT_COOKIE, "chocolate=chip");
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
 +  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
   curl_easy_setopt(hnd, CURLOPT_PROTOCOLS, (long)CURLPROTO_FILE |
                                            (long)CURLPROTO_FTP |
 diff --git a/tests/data/test1402 b/tests/data/test1402
 index 9a94283..ef55bd6 100644
 --- a/tests/data/test1402
 +++ b/tests/data/test1402
@@ -80,6 +80,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
 +  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
   /* Here is a list of options the curl code used that cannot get generated
 diff --git a/tests/data/test1403 b/tests/data/test1403
 index 79cdf49..78932c2 100644
 --- a/tests/data/test1403
 +++ b/tests/data/test1403
@@ -75,6 +75,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
 +  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
   /* Here is a list of options the curl code used that cannot get generated
 diff --git a/tests/data/test1404 b/tests/data/test1404
 index 9c6f2e7..8ea5e04 100644
 --- a/tests/data/test1404
 +++ b/tests/data/test1404
@@ -144,6 +144,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
 +  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
   /* Here is a list of options the curl code used that cannot get generated
 diff --git a/tests/data/test1405 b/tests/data/test1405
 index 73769ee..5a83b6e 100644
 --- a/tests/data/test1405
 +++ b/tests/data/test1405
@@ -89,6 +89,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_POSTQUOTE, slist2);
   curl_easy_setopt(hnd, CURLOPT_PREQUOTE, slist3);
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
 +  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
   /* Here is a list of options the curl code used that cannot get generated
 diff --git a/tests/data/test1406 b/tests/data/test1406
 index 796dd22..c941e00 100644
 --- a/tests/data/test1406
 +++ b/tests/data/test1406
@@ -80,6 +80,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_URL, "smtp://%HOSTIP:%SMTPPORT/1406");
   curl_easy_setopt(hnd, CURLOPT_UPLOAD, 1L);
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
 +  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
   curl_easy_setopt(hnd, CURLOPT_MAIL_FROM, "sender@example.com");
   curl_easy_setopt(hnd, CURLOPT_MAIL_RCPT, slist1);
 diff --git a/tests/data/test1407 b/tests/data/test1407
 index 9800eee..ddba7b7 100644
 --- a/tests/data/test1407
 +++ b/tests/data/test1407
@@ -62,6 +62,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_DIRLISTONLY, 1L);
   curl_easy_setopt(hnd, CURLOPT_USERPWD, "user:secret");
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
 +  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
   /* Here is a list of options the curl code used that cannot get generated
 diff --git a/tests/data/test1420 b/tests/data/test1420
 index a5e1c52..72fb353 100644
 --- a/tests/data/test1420
 +++ b/tests/data/test1420
@@ -67,6 +67,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_URL, "imap://%HOSTIP:%IMAPPORT/1420/;UID=1");
   curl_easy_setopt(hnd, CURLOPT_USERPWD, "user:secret");
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
 +  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
   /* Here is a list of options the curl code used that cannot get generated
 -- 
 2.26.2
--- a/SOURCES/0026-curl-7.61.1-CVE-2020-8285.patch
+++ b/SOURCES/0026-curl-7.61.1-CVE-2020-8285.patch
@ -0,0 +1,258 @@
 From 22b3d1cf0216f4369f01678c587da265c2e465af Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Sat, 28 Nov 2020 00:27:21 +0100
 Subject: [PATCH] ftp: make wc_statemach loop instead of recurse
 CVE-2020-8285
 Fixes #6255
 Bug: https://curl.se/docs/CVE-2020-8285.html
 Reported-by: xnynx on github
 Upstream-commit: 69a358f2186e04cf44698b5100332cbf1ee7f01d
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/ftp.c | 204 +++++++++++++++++++++++++++---------------------------
 1 file changed, 103 insertions(+), 101 deletions(-)
 diff --git a/lib/ftp.c b/lib/ftp.c
 index 7dbf080..482ab3a 100644
 --- a/lib/ftp.c
 +++ b/lib/ftp.c
@@ -3786,130 +3786,132 @@ static CURLcode init_wc_data(struct connectdata *conn)
   return result;
 }
 -/* This is called recursively */
 static CURLcode wc_statemach(struct connectdata *conn)
 {
   struct WildcardData * const wildcard = &(conn->data->wildcard);
   CURLcode result = CURLE_OK;
 -  switch(wildcard->state) {
 -  case CURLWC_INIT:
 -    result = init_wc_data(conn);
 -    if(wildcard->state == CURLWC_CLEAN)
 -      /* only listing! */
 -      break;
 -    wildcard->state = result ? CURLWC_ERROR : CURLWC_MATCHING;
 -    break;
 +  for(;;) {
 +    switch(wildcard->state) {
 +    case CURLWC_INIT:
 +      result = init_wc_data(conn);
 +      if(wildcard->state == CURLWC_CLEAN)
 +        /* only listing! */
 +        return result;
 +      wildcard->state = result ? CURLWC_ERROR : CURLWC_MATCHING;
 +      return result;
 -  case CURLWC_MATCHING: {
 -    /* In this state is LIST response successfully parsed, so lets restore
 -       previous WRITEFUNCTION callback and WRITEDATA pointer */
 -    struct ftp_wc *ftpwc = wildcard->protdata;
 -    conn->data->set.fwrite_func = ftpwc->backup.write_function;
 -    conn->data->set.out = ftpwc->backup.file_descriptor;
 -    ftpwc->backup.write_function = ZERO_NULL;
 -    ftpwc->backup.file_descriptor = NULL;
 -    wildcard->state = CURLWC_DOWNLOADING;
 -
 -    if(Curl_ftp_parselist_geterror(ftpwc->parser)) {
 -      /* error found in LIST parsing */
 -      wildcard->state = CURLWC_CLEAN;
 -      return wc_statemach(conn);
 -    }
 -    if(wildcard->filelist.size == 0) {
 -      /* no corresponding file */
 -      wildcard->state = CURLWC_CLEAN;
 -      return CURLE_REMOTE_FILE_NOT_FOUND;
 +    case CURLWC_MATCHING: {
 +      /* In this state is LIST response successfully parsed, so lets restore
 +         previous WRITEFUNCTION callback and WRITEDATA pointer */
 +      struct ftp_wc *ftpwc = wildcard->protdata;
 +      conn->data->set.fwrite_func = ftpwc->backup.write_function;
 +      conn->data->set.out = ftpwc->backup.file_descriptor;
 +      ftpwc->backup.write_function = ZERO_NULL;
 +      ftpwc->backup.file_descriptor = NULL;
 +      wildcard->state = CURLWC_DOWNLOADING;
 +
 +      if(Curl_ftp_parselist_geterror(ftpwc->parser)) {
 +        /* error found in LIST parsing */
 +        wildcard->state = CURLWC_CLEAN;
 +        continue;
 +      }
 +      if(wildcard->filelist.size == 0) {
 +        /* no corresponding file */
 +        wildcard->state = CURLWC_CLEAN;
 +        return CURLE_REMOTE_FILE_NOT_FOUND;
 +      }
 +      continue;
     }
 -    return wc_statemach(conn);
 -  }
 -  case CURLWC_DOWNLOADING: {
 -    /* filelist has at least one file, lets get first one */
 -    struct ftp_conn *ftpc = &conn->proto.ftpc;
 -    struct curl_fileinfo *finfo = wildcard->filelist.head->ptr;
 +    case CURLWC_DOWNLOADING: {
 +      /* filelist has at least one file, lets get first one */
 +      struct ftp_conn *ftpc = &conn->proto.ftpc;
 +      struct curl_fileinfo *finfo = wildcard->filelist.head->ptr;
 -    char *tmp_path = aprintf("%s%s", wildcard->path, finfo->filename);
 -    if(!tmp_path)
 -      return CURLE_OUT_OF_MEMORY;
 +      char *tmp_path = aprintf("%s%s", wildcard->path, finfo->filename);
 +      if(!tmp_path)
 +        return CURLE_OUT_OF_MEMORY;
 -    /* switch default "state.pathbuffer" and tmp_path, good to see
 -       ftp_parse_url_path function to understand this trick */
 -    Curl_safefree(conn->data->state.pathbuffer);
 -    conn->data->state.pathbuffer = tmp_path;
 -    conn->data->state.path = tmp_path;
 -
 -    infof(conn->data, "Wildcard - START of \"%s\"\n", finfo->filename);
 -    if(conn->data->set.chunk_bgn) {
 -      long userresponse;
 -      Curl_set_in_callback(conn->data, true);
 -      userresponse = conn->data->set.chunk_bgn(
 -        finfo, wildcard->customptr, (int)wildcard->filelist.size);
 -      Curl_set_in_callback(conn->data, false);
 -      switch(userresponse) {
 -      case CURL_CHUNK_BGN_FUNC_SKIP:
 -        infof(conn->data, "Wildcard - \"%s\" skipped by user\n",
 -              finfo->filename);
 -        wildcard->state = CURLWC_SKIP;
 -        return wc_statemach(conn);
 -      case CURL_CHUNK_BGN_FUNC_FAIL:
 -        return CURLE_CHUNK_FAILED;
 +      /* switch default "state.pathbuffer" and tmp_path, good to see
 +         ftp_parse_url_path function to understand this trick */
 +      Curl_safefree(conn->data->state.pathbuffer);
 +      conn->data->state.pathbuffer = tmp_path;
 +      conn->data->state.path = tmp_path;
 +
 +      infof(conn->data, "Wildcard - START of \"%s\"\n", finfo->filename);
 +      if(conn->data->set.chunk_bgn) {
 +        long userresponse;
 +        Curl_set_in_callback(conn->data, true);
 +        userresponse = conn->data->set.chunk_bgn(
 +          finfo, wildcard->customptr, (int)wildcard->filelist.size);
 +        Curl_set_in_callback(conn->data, false);
 +        switch(userresponse) {
 +        case CURL_CHUNK_BGN_FUNC_SKIP:
 +          infof(conn->data, "Wildcard - \"%s\" skipped by user\n",
 +                finfo->filename);
 +          wildcard->state = CURLWC_SKIP;
 +          continue;
 +        case CURL_CHUNK_BGN_FUNC_FAIL:
 +          return CURLE_CHUNK_FAILED;
 +        }
       }
 -    }
 -    if(finfo->filetype != CURLFILETYPE_FILE) {
 -      wildcard->state = CURLWC_SKIP;
 -      return wc_statemach(conn);
 -    }
 +      if(finfo->filetype != CURLFILETYPE_FILE) {
 +        wildcard->state = CURLWC_SKIP;
 +        continue;
 +      }
 -    if(finfo->flags & CURLFINFOFLAG_KNOWN_SIZE)
 -      ftpc->known_filesize = finfo->size;
 +      if(finfo->flags & CURLFINFOFLAG_KNOWN_SIZE)
 +        ftpc->known_filesize = finfo->size;
 -    result = ftp_parse_url_path(conn);
 -    if(result)
 -      return result;
 +      result = ftp_parse_url_path(conn);
 +      if(result)
 +        return result;
 -    /* we don't need the Curl_fileinfo of first file anymore */
 -    Curl_llist_remove(&wildcard->filelist, wildcard->filelist.head, NULL);
 +      /* we don't need the Curl_fileinfo of first file anymore */
 +      Curl_llist_remove(&wildcard->filelist, wildcard->filelist.head, NULL);
 -    if(wildcard->filelist.size == 0) { /* remains only one file to down. */
 -      wildcard->state = CURLWC_CLEAN;
 -      /* after that will be ftp_do called once again and no transfer
 -         will be done because of CURLWC_CLEAN state */
 -      return CURLE_OK;
 +      if(wildcard->filelist.size == 0) { /* remains only one file to down. */
 +        wildcard->state = CURLWC_CLEAN;
 +        /* after that will be ftp_do called once again and no transfer
 +           will be done because of CURLWC_CLEAN state */
 +        return CURLE_OK;
 +      }
 +      return result;
     }
 -  } break;
 -  case CURLWC_SKIP: {
 -    if(conn->data->set.chunk_end) {
 -      Curl_set_in_callback(conn->data, true);
 -      conn->data->set.chunk_end(conn->data->wildcard.customptr);
 -      Curl_set_in_callback(conn->data, false);
 +    case CURLWC_SKIP: {
 +      if(conn->data->set.chunk_end) {
 +        Curl_set_in_callback(conn->data, true);
 +        conn->data->set.chunk_end(conn->data->wildcard.customptr);
 +        Curl_set_in_callback(conn->data, false);
 +      }
 +      Curl_llist_remove(&wildcard->filelist, wildcard->filelist.head, NULL);
 +      wildcard->state = (wildcard->filelist.size == 0) ?
 +        CURLWC_CLEAN : CURLWC_DOWNLOADING;
 +      continue;
     }
 -    Curl_llist_remove(&wildcard->filelist, wildcard->filelist.head, NULL);
 -    wildcard->state = (wildcard->filelist.size == 0) ?
 -                      CURLWC_CLEAN : CURLWC_DOWNLOADING;
 -    return wc_statemach(conn);
 -  }
 -  case CURLWC_CLEAN: {
 -    struct ftp_wc *ftpwc = wildcard->protdata;
 -    result = CURLE_OK;
 -    if(ftpwc)
 -      result = Curl_ftp_parselist_geterror(ftpwc->parser);
 +    case CURLWC_CLEAN: {
 +      struct ftp_wc *ftpwc = wildcard->protdata;
 +      result = CURLE_OK;
 +      if(ftpwc)
 +        result = Curl_ftp_parselist_geterror(ftpwc->parser);
 -    wildcard->state = result ? CURLWC_ERROR : CURLWC_DONE;
 -  } break;
 +      wildcard->state = result ? CURLWC_ERROR : CURLWC_DONE;
 +      return result;
 +    }
 -  case CURLWC_DONE:
 -  case CURLWC_ERROR:
 -  case CURLWC_CLEAR:
 -    if(wildcard->dtor)
 -      wildcard->dtor(wildcard->protdata);
 -    break;
 +    case CURLWC_DONE:
 +    case CURLWC_ERROR:
 +    case CURLWC_CLEAR:
 +      if(wildcard->dtor)
 +        wildcard->dtor(wildcard->protdata);
 +      return result;
 +    }
   }
 -
 -  return result;
 +  /* UNREACHABLE */
 }
 /***********************************************************************
 -- 
 2.26.2
--- a/SOURCES/0027-curl-7.61.1-CVE-2020-8286.patch
+++ b/SOURCES/0027-curl-7.61.1-CVE-2020-8286.patch
@ -0,0 +1,129 @@
 From 2470bc91f62cc9b0ab1deac60a67f87b7cc95f6e Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Wed, 2 Dec 2020 23:01:11 +0100
 Subject: [PATCH] openssl: make the OCSP verification verify the certificate id
 CVE-2020-8286
 Reported by anonymous
 Bug: https://curl.se/docs/CVE-2020-8286.html
 Upstream-commit: d9d01672785b8ac04aab1abb6de95fe3072ae199
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/vtls/openssl.c | 83 ++++++++++++++++++++++++++++++----------------
 1 file changed, 54 insertions(+), 29 deletions(-)
 diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
 index 9476773..35cd652 100644
 --- a/lib/vtls/openssl.c
 +++ b/lib/vtls/openssl.c
@@ -1659,6 +1659,11 @@ static CURLcode verifystatus(struct connectdata *conn,
   OCSP_BASICRESP *br = NULL;
   X509_STORE     *st = NULL;
   STACK_OF(X509) *ch = NULL;
 +  X509 *cert;
 +  OCSP_CERTID *id = NULL;
 +  int cert_status, crl_reason;
 +  ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
 +  int ret;
   long len = SSL_get_tlsext_status_ocsp_resp(BACKEND->handle, &p);
@@ -1727,43 +1732,63 @@ static CURLcode verifystatus(struct connectdata *conn,
     goto end;
   }
 -  for(i = 0; i < OCSP_resp_count(br); i++) {
 -    int cert_status, crl_reason;
 -    OCSP_SINGLERESP *single = NULL;
 -
 -    ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
 +  /* Compute the certificate's ID */
 +  cert = SSL_get_peer_certificate(BACKEND->handle);
 +  if(!cert) {
 +    failf(data, "Error getting peer certficate");
 +    result = CURLE_SSL_INVALIDCERTSTATUS;
 +    goto end;
 +  }
 -    single = OCSP_resp_get0(br, i);
 -    if(!single)
 -      continue;
 +  for(i = 0; i < sk_X509_num(ch); i++) {
 +    X509 *issuer = sk_X509_value(ch, i);
 +    if(X509_check_issued(issuer, cert) == X509_V_OK) {
 +      id = OCSP_cert_to_id(EVP_sha1(), cert, issuer);
 +      break;
 +    }
 +  }
 +  X509_free(cert);
 -    cert_status = OCSP_single_get0_status(single, &crl_reason, &rev,
 -                                          &thisupd, &nextupd);
 +  if(!id) {
 +    failf(data, "Error computing OCSP ID");
 +    result = CURLE_SSL_INVALIDCERTSTATUS;
 +    goto end;
 +  }
 -    if(!OCSP_check_validity(thisupd, nextupd, 300L, -1L)) {
 -      failf(data, "OCSP response has expired");
 -      result = CURLE_SSL_INVALIDCERTSTATUS;
 -      goto end;
 -    }
 +  /* Find the single OCSP response corresponding to the certificate ID */
 +  ret = OCSP_resp_find_status(br, id, &cert_status, &crl_reason, &rev,
 +                              &thisupd, &nextupd);
 +  OCSP_CERTID_free(id);
 +  if(ret != 1) {
 +    failf(data, "Could not find certificate ID in OCSP response");
 +    result = CURLE_SSL_INVALIDCERTSTATUS;
 +    goto end;
 +  }
 -    infof(data, "SSL certificate status: %s (%d)\n",
 -          OCSP_cert_status_str(cert_status), cert_status);
 +  /* Validate the corresponding single OCSP response */
 +  if(!OCSP_check_validity(thisupd, nextupd, 300L, -1L)) {
 +    failf(data, "OCSP response has expired");
 +    result = CURLE_SSL_INVALIDCERTSTATUS;
 +    goto end;
 +  }
 -    switch(cert_status) {
 -      case V_OCSP_CERTSTATUS_GOOD:
 -        break;
 +  infof(data, "SSL certificate status: %s (%d)\n",
 +        OCSP_cert_status_str(cert_status), cert_status);
 -      case V_OCSP_CERTSTATUS_REVOKED:
 -        result = CURLE_SSL_INVALIDCERTSTATUS;
 +  switch(cert_status) {
 +  case V_OCSP_CERTSTATUS_GOOD:
 +    break;
 -        failf(data, "SSL certificate revocation reason: %s (%d)",
 -              OCSP_crl_reason_str(crl_reason), crl_reason);
 -        goto end;
 +  case V_OCSP_CERTSTATUS_REVOKED:
 +    result = CURLE_SSL_INVALIDCERTSTATUS;
 +    failf(data, "SSL certificate revocation reason: %s (%d)",
 +          OCSP_crl_reason_str(crl_reason), crl_reason);
 +    goto end;
 -      case V_OCSP_CERTSTATUS_UNKNOWN:
 -        result = CURLE_SSL_INVALIDCERTSTATUS;
 -        goto end;
 -    }
 +  case V_OCSP_CERTSTATUS_UNKNOWN:
 +  default:
 +    result = CURLE_SSL_INVALIDCERTSTATUS;
 +    goto end;
   }
 end:
 -- 
 2.26.2
--- a/SOURCES/0028-curl-7.61.1-http-auth-payload.patch
+++ b/SOURCES/0028-curl-7.61.1-http-auth-payload.patch
@ -0,0 +1,63 @@
 From 5a51924c2505c1d5616904aa732fdaedd74d3ffe Mon Sep 17 00:00:00 2001
 From: Marc Schlatter <mschlatter@gestour.com>
 Date: Mon, 11 Mar 2019 17:15:34 +0100
 Subject: [PATCH] http: send payload when (proxy) authentication is done
 The check that prevents payload from sending in case of authentication
 doesn't check properly if the authentication is done or not.
 They're cases where the proxy respond "200 OK" before sending
 authentication challenge. This change takes care of that.
 Fixes #2431
 Closes #3669
 Upstream-commit: dd8a19f8a05b59394d1ab33c09497e8db884742a
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/http.c          | 3 ++-
 tests/data/test1097 | 5 +++--
 2 files changed, 5 insertions(+), 3 deletions(-)
 diff --git a/lib/http.c b/lib/http.c
 index e727ed8..26eb52d 100644
 --- a/lib/http.c
 +++ b/lib/http.c
@@ -1991,7 +1991,8 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
   if(result)
     return result;
 -  if((data->state.authhost.multipass || data->state.authproxy.multipass) &&
 +  if(((data->state.authhost.multipass && !data->state.authhost.done)
 +      || (data->state.authproxy.multipass && !data->state.authproxy.done)) &&
      (httpreq != HTTPREQ_GET) &&
      (httpreq != HTTPREQ_HEAD)) {
     /* Auth is required and we are not authenticated yet. Make a PUT or POST
 diff --git a/tests/data/test1097 b/tests/data/test1097
 index 7512a2e..7eb7b5f 100644
 --- a/tests/data/test1097
 +++ b/tests/data/test1097
@@ -60,7 +60,7 @@ http://test.a.galaxy.far.far.away.1097:%HTTPPORT/1097 --proxy http://%HOSTIP:%HT
 <strip>
 ^User-Agent: curl/.*
 </strip>
 -<protocol>
 +<protocol nonewline="yes">
 CONNECT test.a.galaxy.far.far.away.1097:%HTTPPORT HTTP/1.1
 Host: test.a.galaxy.far.far.away.1097:%HTTPPORT
 Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
@@ -71,9 +71,10 @@ POST /1097 HTTP/1.1
 User-Agent: curl/7.19.5-CVS (i686-pc-linux-gnu) libcurl/7.19.5-CVS OpenSSL/0.9.8g zlib/1.2.3.3 c-ares/1.6.1-CVS libidn/1.12 libssh2/1.0.1_CVS
 Host: test.a.galaxy.far.far.away.1097:%HTTPPORT
 Accept: */*
 -Content-Length: 0
 +Content-Length: 11
 Content-Type: application/x-www-form-urlencoded
 +dummy=value
 </protocol>
 </verify>
 -- 
 2.26.2
--- a/SOURCES/0029-curl-7.61.1-CVE-2021-22876.patch
+++ b/SOURCES/0029-curl-7.61.1-CVE-2021-22876.patch
@ -0,0 +1,116 @@
 From 239f8d93866605b05f4e6b551f4327dc7fcb922b Mon Sep 17 00:00:00 2001
 From: Viktor Szakats <commit@vsz.me>
 Date: Tue, 23 Feb 2021 14:54:46 +0100
 Subject: [PATCH 1/2] transfer: strip credentials from the auto-referer header
 field
 Added test 2081 to verify.
 CVE-2021-22876
 Bug: https://curl.se/docs/CVE-2021-22876.html
 Upstream-commit: 7214288898f5625a6cc196e22a74232eada7861c
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/transfer.c | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)
 diff --git a/lib/transfer.c b/lib/transfer.c
 index ecd1063..263b178 100644
 --- a/lib/transfer.c
 +++ b/lib/transfer.c
@@ -1473,6 +1473,7 @@ CURLcode Curl_follow(struct Curl_easy *data,
   /* Location: redirect */
   bool disallowport = FALSE;
   bool reachedmax = FALSE;
 +  CURLUcode uc;
   if(type == FOLLOW_REDIR) {
     if((data->set.maxredirs != -1) &&
@@ -1488,6 +1489,9 @@ CURLcode Curl_follow(struct Curl_easy *data,
       data->set.followlocation++; /* count location-followers */
       if(data->set.http_auto_referer) {
 +        CURLU *u;
 +        char *referer;
 +
         /* We are asked to automatically set the previous URL as the referer
            when we get the next URL. We pick the ->url field, which may or may
            not be 100% correct */
@@ -1497,9 +1501,26 @@ CURLcode Curl_follow(struct Curl_easy *data,
           data->change.referer_alloc = FALSE;
         }
 -        data->change.referer = strdup(data->change.url);
 -        if(!data->change.referer)
 +        /* Make a copy of the URL without crenditals and fragment */
 +        u = curl_url();
 +        if(!u)
 +          return CURLE_OUT_OF_MEMORY;
 +
 +        uc = curl_url_set(u, CURLUPART_URL, data->change.url, 0);
 +        if(!uc)
 +          uc = curl_url_set(u, CURLUPART_FRAGMENT, NULL, 0);
 +        if(!uc)
 +          uc = curl_url_set(u, CURLUPART_USER, NULL, 0);
 +        if(!uc)
 +          uc = curl_url_set(u, CURLUPART_PASSWORD, NULL, 0);
 +        if(!uc)
 +          uc = curl_url_get(u, CURLUPART_URL, &referer, 0);
 +
 +        curl_url_cleanup(u);
 +
 +        if(uc || referer == NULL)
           return CURLE_OUT_OF_MEMORY;
 +        data->change.referer = referer;
         data->change.referer_alloc = TRUE; /* yes, free this later */
       }
     }
 -- 
 2.30.2
 From f7d1d478b87499ce31d6aa3251830b78447ad952 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 29 Mar 2021 09:32:14 +0200
 Subject: [PATCH 2/2] transfer: clear 'referer' in declaration
 To silence (false positive) compiler warnings about it.
 Follow-up to 7214288898f5625
 Reviewed-by: Marcel Raad
 Closes #6810
 Upstream-commit: 6bb028dbda6cbfe83f66de773544f71e4813160f
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/transfer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/lib/transfer.c b/lib/transfer.c
 index 263b178..ad5a7ba 100644
 --- a/lib/transfer.c
 +++ b/lib/transfer.c
@@ -1490,7 +1490,7 @@ CURLcode Curl_follow(struct Curl_easy *data,
       if(data->set.http_auto_referer) {
         CURLU *u;
 -        char *referer;
 +        char *referer = NULL;
         /* We are asked to automatically set the previous URL as the referer
            when we get the next URL. We pick the ->url field, which may or may
@@ -1518,7 +1518,7 @@ CURLcode Curl_follow(struct Curl_easy *data,
         curl_url_cleanup(u);
 -        if(uc || referer == NULL)
 +        if(uc || !referer)
           return CURLE_OUT_OF_MEMORY;
         data->change.referer = referer;
         data->change.referer_alloc = TRUE; /* yes, free this later */
 -- 
 2.30.2
--- a/SOURCES/0030-curl-7.61.1-file-head.patch
+++ b/SOURCES/0030-curl-7.61.1-file-head.patch
@ -0,0 +1,693 @@
 From 87e3d094e0dc00efc1abeb2b142d453024cbca69 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 4 Oct 2018 23:53:32 +0200
 Subject: [PATCH] FILE: fix CURLOPT_NOBODY and CURLOPT_HEADER output
 Now FILE transfers send headers to the header callback like HTTP and
 other protocols. Also made curl_easy_getinfo(...CURLINFO_PROTOCOL...)
 work for FILE in the callbacks.
 Makes "curl -i file://.." and "curl -I file://.." work like before
 again. Applied the bold header logic to them too.
 Regression from c1c2762 (7.61.0)
 Reported-by: Shaun Jackman
 Fixes #3083
 Closes #3101
 Upstream-commit: e50a2002bd450a4800a165d2874ed79c95b33a07
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/file.c          | 27 +++++++++++++--------------
 lib/getinfo.c       |  1 -
 lib/url.c           |  1 +
 src/tool_cb_hdr.c   |  5 +++--
 tests/data/test1016 |  2 +-
 tests/data/test1017 |  2 +-
 tests/data/test1018 |  2 +-
 tests/data/test1019 |  2 +-
 tests/data/test1020 |  2 +-
 tests/data/test1029 |  2 +-
 tests/data/test1146 |  2 +-
 tests/data/test1220 |  2 +-
 tests/data/test200  |  2 +-
 tests/data/test2000 |  2 +-
 tests/data/test2001 | 13 +------------
 tests/data/test2002 | 13 +------------
 tests/data/test2003 | 26 ++------------------------
 tests/data/test2004 |  2 +-
 tests/data/test2006 |  8 ++++++++
 tests/data/test2007 |  8 ++++++++
 tests/data/test2008 |  8 ++++++++
 tests/data/test2009 |  8 ++++++++
 tests/data/test2010 |  8 ++++++++
 tests/data/test202  |  2 +-
 tests/data/test203  |  2 +-
 tests/data/test204  |  2 +-
 tests/data/test205  |  2 +-
 tests/data/test2070 |  2 +-
 tests/data/test2071 |  2 +-
 tests/data/test2072 |  2 +-
 tests/data/test210  |  2 +-
 tests/data/test231  |  2 +-
 tests/data/test288  |  2 +-
 33 files changed, 82 insertions(+), 86 deletions(-)
 diff --git a/lib/file.c b/lib/file.c
 index e50e988..f780658 100644
 --- a/lib/file.c
 +++ b/lib/file.c
@@ -386,7 +386,6 @@ static CURLcode file_do(struct connectdata *conn, bool *done)
   *done = TRUE; /* unconditionally */
 -  Curl_initinfo(data);
   Curl_pgrsStartNow(data);
   if(data->set.upload)
@@ -413,21 +412,18 @@ static CURLcode file_do(struct connectdata *conn, bool *done)
     }
   }
 -  /* If we have selected NOBODY and HEADER, it means that we only want file
 -     information. Which for FILE can't be much more than the file size and
 -     date. */
 -  if(data->set.opt_no_body && data->set.include_header && fstated) {
 +  if(fstated) {
     time_t filetime;
     struct tm buffer;
     const struct tm *tm = &buffer;
     char header[80];
     snprintf(header, sizeof(header),
              "Content-Length: %" CURL_FORMAT_CURL_OFF_T "\r\n", expected_size);
 -    result = Curl_client_write(conn, CLIENTWRITE_BOTH, header, 0);
 +    result = Curl_client_write(conn, CLIENTWRITE_HEADER, header, 0);
     if(result)
       return result;
 -    result = Curl_client_write(conn, CLIENTWRITE_BOTH,
 +    result = Curl_client_write(conn, CLIENTWRITE_HEADER,
                                (char *)"Accept-ranges: bytes\r\n", 0);
     if(result)
       return result;
@@ -439,19 +435,22 @@ static CURLcode file_do(struct connectdata *conn, bool *done)
     /* format: "Tue, 15 Nov 1994 12:45:26 GMT" */
     snprintf(header, sizeof(header),
 -             "Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n",
 +             "Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n%s",
              Curl_wkday[tm->tm_wday?tm->tm_wday-1:6],
              tm->tm_mday,
              Curl_month[tm->tm_mon],
              tm->tm_year + 1900,
              tm->tm_hour,
              tm->tm_min,
 -             tm->tm_sec);
 -    result = Curl_client_write(conn, CLIENTWRITE_BOTH, header, 0);
 -    if(!result)
 -      /* set the file size to make it available post transfer */
 -      Curl_pgrsSetDownloadSize(data, expected_size);
 -    return result;
 +             tm->tm_sec,
 +             data->set.opt_no_body ? "": "\r\n");
 +    result = Curl_client_write(conn, CLIENTWRITE_HEADER, header, 0);
 +    if(result)
 +      return result;
 +    /* set the file size to make it available post transfer */
 +    Curl_pgrsSetDownloadSize(data, expected_size);
 +    if(data->set.opt_no_body)
 +      return result;
   }
   /* Check whether file range has been specified */
 diff --git a/lib/getinfo.c b/lib/getinfo.c
 index 14b4562..54c2c2f 100644
 --- a/lib/getinfo.c
 +++ b/lib/getinfo.c
@@ -85,7 +85,6 @@ CURLcode Curl_initinfo(struct Curl_easy *data)
 #ifdef USE_SSL
   Curl_ssl_free_certinfo(data);
 #endif
 -
   return CURLE_OK;
 }
 diff --git a/lib/url.c b/lib/url.c
 index b18db25..bb9d107 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -4290,6 +4290,7 @@ static CURLcode create_conn(struct Curl_easy *data,
     /* this is supposed to be the connect function so we better at least check
        that the file is present here! */
     DEBUGASSERT(conn->handler->connect_it);
 +    Curl_persistconninfo(conn);
     result = conn->handler->connect_it(conn, &done);
     /* Setup a "faked" transfer that'll do nothing */
 diff --git a/src/tool_cb_hdr.c b/src/tool_cb_hdr.c
 index e91e8ac..4f21221 100644
 --- a/src/tool_cb_hdr.c
 +++ b/src/tool_cb_hdr.c
@@ -153,8 +153,9 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
   }
   if(hdrcbdata->config->show_headers &&
 -     (protocol & (CURLPROTO_HTTP|CURLPROTO_HTTPS|CURLPROTO_RTSP))) {
 -    /* bold headers only happen for HTTP(S) and RTSP */
 +    (protocol &
 +     (CURLPROTO_HTTP|CURLPROTO_HTTPS|CURLPROTO_RTSP|CURLPROTO_FILE))) {
 +    /* bold headers only for selected protocols */
     char *value = NULL;
     if(!outs->stream && !tool_create_output_file(outs))
 diff --git a/tests/data/test1016 b/tests/data/test1016
 index b404cac..4927f9e 100644
 --- a/tests/data/test1016
 +++ b/tests/data/test1016
@@ -22,7 +22,7 @@ file
  <name>
 X-Y range on a file:// URL to stdout
  </name>
 - <command>
 +<command option="no-include">
 -r 1-4 file://localhost/%PWD/log/test1016.txt 
 </command>
 <file name="log/test1016.txt">
 diff --git a/tests/data/test1017 b/tests/data/test1017
 index 6fbc38a..cfdd80f 100644
 --- a/tests/data/test1017
 +++ b/tests/data/test1017
@@ -23,7 +23,7 @@ file
  <name>
 0-Y range on a file:// URL to stdout
  </name>
 - <command>
 +<command option="no-include">
 -r 0-3 file://localhost/%PWD/log/test1017.txt 
 </command>
 <file name="log/test1017.txt">
 diff --git a/tests/data/test1018 b/tests/data/test1018
 index 28a7027..5748701 100644
 --- a/tests/data/test1018
 +++ b/tests/data/test1018
@@ -22,7 +22,7 @@ file
  <name>
 X-X range on a file:// URL to stdout
  </name>
 - <command>
 +<command option="no-include">
 -r 4-4 file://localhost/%PWD/log/test1018.txt 
 </command>
 <file name="log/test1018.txt">
 diff --git a/tests/data/test1019 b/tests/data/test1019
 index 4d9872a..054e38d 100644
 --- a/tests/data/test1019
 +++ b/tests/data/test1019
@@ -23,7 +23,7 @@ file
  <name>
 X- range on a file:// URL to stdout
  </name>
 - <command>
 +<command option="no-include">
 -r 7- file://localhost/%PWD/log/test1019.txt 
 </command>
 <file name="log/test1019.txt">
 diff --git a/tests/data/test1020 b/tests/data/test1020
 index 735871d..e924529 100644
 --- a/tests/data/test1020
 +++ b/tests/data/test1020
@@ -23,7 +23,7 @@ file
  <name>
 -Y range on a file:// URL to stdout
  </name>
 - <command>
 +<command option="no-include">
 -r -9 file://localhost/%PWD/log/test1020.txt 
 </command>
 <file name="log/test1020.txt">
 diff --git a/tests/data/test1029 b/tests/data/test1029
 index 2ffc7c6..c77209c 100644
 --- a/tests/data/test1029
 +++ b/tests/data/test1029
@@ -29,7 +29,7 @@ http
  <name>
 HTTP Location: and 'redirect_url' check
  </name>
 - <command>
 +<command>
 http://%HOSTIP:%HTTPPORT/we/want/our/1029 -w '%{redirect_url}\n'
 </command>
 </client>
 diff --git a/tests/data/test1146 b/tests/data/test1146
 index 43f33b7..636748e 100644
 --- a/tests/data/test1146
 +++ b/tests/data/test1146
@@ -24,7 +24,7 @@ file
 <name>
 --proto-default file
 </name>
 -<command>
 +<command option="no-include">
 --proto-default file %PWD/log/test1146.txt
 </command>
 <file name="log/test1146.txt">
 diff --git a/tests/data/test1220 b/tests/data/test1220
 index 959abbf..6752eb5 100644
 --- a/tests/data/test1220
 +++ b/tests/data/test1220
@@ -20,7 +20,7 @@ file
  <name>
 file:// URLs with query string
  </name>
 - <command>
 +<command option="no-include">
 file://localhost/%PWD/log/test1220.txt?a_query=foobar#afragment
 </command>
 <file name="log/test1220.txt">
 diff --git a/tests/data/test200 b/tests/data/test200
 index 8be1de0..c27f7c0 100644
 --- a/tests/data/test200
 +++ b/tests/data/test200
@@ -23,7 +23,7 @@ file
  <name>
 basic file:// file
  </name>
 - <command>
 +<command option="no-include">
 file://localhost/%PWD/log/test200.txt
 </command>
 <file name="log/test200.txt">
 diff --git a/tests/data/test2000 b/tests/data/test2000
 index d3edb16..db1ba13 100644
 --- a/tests/data/test2000
 +++ b/tests/data/test2000
@@ -31,7 +31,7 @@ file
  <name>
 FTP RETR followed by FILE
  </name>
 - <command>
 +<command option="no-include">
 ftp://%HOSTIP:%FTPPORT/2000 file://localhost/%PWD/log/test2000.txt
 </command>
 <file name="log/test2000.txt">
 diff --git a/tests/data/test2001 b/tests/data/test2001
 index 68c0df7..88a258e 100644
 --- a/tests/data/test2001
 +++ b/tests/data/test2001
@@ -48,7 +48,7 @@ file
  <name>
 HTTP GET followed by FTP RETR followed by FILE
  </name>
 - <command>
 +<command option="no-include">
 http://%HOSTIP:%HTTPPORT/20010001 ftp://%HOSTIP:%FTPPORT/20010002 file://localhost/%PWD/log/test2001.txt
 </command>
 <file name="log/test2001.txt">
@@ -81,17 +81,6 @@ RETR 20010002
 QUIT
 </protocol>
 <stdout>
 -HTTP/1.1 200 OK
 -Date: Thu, 09 Nov 2010 14:49:00 GMT
 -Server: test-server/fake
 -Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
 -ETag: "21025-dc7-39462498"
 -Accept-Ranges: bytes
 -Content-Length: 6
 -Connection: close
 -Content-Type: text/html
 -Funny-head: yesyes
 -
 -foo-
 data
     to
 diff --git a/tests/data/test2002 b/tests/data/test2002
 index db96bfe..6dd2f93 100644
 --- a/tests/data/test2002
 +++ b/tests/data/test2002
@@ -57,7 +57,7 @@ tftp
  <name>
 HTTP GET followed by FTP RETR followed by FILE followed by TFTP RRQ
  </name>
 - <command>
 +<command option="no-include">
 http://%HOSTIP:%HTTPPORT/20020001 ftp://%HOSTIP:%FTPPORT/20020002 file://localhost/%PWD/log/test2002.txt tftp://%HOSTIP:%TFTPPORT//20020003
 </command>
 <file name="log/test2002.txt">
@@ -96,17 +96,6 @@ filename: /20020003
 QUIT
 </protocol>
 <stdout>
 -HTTP/1.1 200 OK
 -Date: Thu, 09 Nov 2010 14:49:00 GMT
 -Server: test-server/fake
 -Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
 -ETag: "21025-dc7-39462498"
 -Accept-Ranges: bytes
 -Content-Length: 6
 -Connection: close
 -Content-Type: text/html
 -Funny-head: yesyes
 -
 -foo-
 data
     to
 diff --git a/tests/data/test2003 b/tests/data/test2003
 index 59a743f..09bee8e 100644
 --- a/tests/data/test2003
 +++ b/tests/data/test2003
@@ -57,8 +57,8 @@ tftp
  <name>
 HTTP GET followed by FTP RETR followed by FILE followed by TFTP RRQ then again in reverse order
  </name>
 - <command>
 -http://%HOSTIP:%HTTPPORT/20030001 ftp://%HOSTIP:%FTPPORT/20030002 file://localhost/%PWD/log/test2003.txt tftp://%HOSTIP:%TFTPPORT//20030003 tftp://%HOSTIP:%TFTPPORT//20030003 file://localhost/%PWD/log/test2003.txt ftp://%HOSTIP:%FTPPORT/20030002 http://%HOSTIP:%HTTPPORT/20030001 
 +<command option="no-include">
 +http://%HOSTIP:%HTTPPORT/20030001 ftp://%HOSTIP:%FTPPORT/20030002 file://localhost/%PWD/log/test2003.txt tftp://%HOSTIP:%TFTPPORT//20030003 tftp://%HOSTIP:%TFTPPORT//20030003 file://localhost/%PWD/log/test2003.txt ftp://%HOSTIP:%FTPPORT/20030002 http://%HOSTIP:%HTTPPORT/20030001
 </command>
 <file name="log/test2003.txt">
 foo
@@ -109,17 +109,6 @@ Accept: */*
 QUIT
 </protocol>
 <stdout>
 -HTTP/1.1 200 OK
 -Date: Thu, 09 Nov 2010 14:49:00 GMT
 -Server: test-server/fake
 -Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
 -ETag: "21025-dc7-39462498"
 -Accept-Ranges: bytes
 -Content-Length: 6
 -Connection: close
 -Content-Type: text/html
 -Funny-head: yesyes
 -
 -foo-
 data
     to
@@ -151,17 +140,6 @@ data
 that FTP
 works
   so does it?
 -HTTP/1.1 200 OK
 -Date: Thu, 09 Nov 2010 14:49:00 GMT
 -Server: test-server/fake
 -Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
 -ETag: "21025-dc7-39462498"
 -Accept-Ranges: bytes
 -Content-Length: 6
 -Connection: close
 -Content-Type: text/html
 -Funny-head: yesyes
 -
 -foo-
 </stdout>
 </verify>
 diff --git a/tests/data/test2004 b/tests/data/test2004
 index 4773f69..b17890b 100644
 --- a/tests/data/test2004
 +++ b/tests/data/test2004
@@ -29,7 +29,7 @@ sftp
  <name>
 TFTP RRQ followed by SFTP retrieval followed by FILE followed by SCP retrieval then again in reverse order
  </name>
 - <command>
 +<command option="no-include">
 --key curl_client_key --pubkey curl_client_key.pub -u %USER: tftp://%HOSTIP:%TFTPPORT//2004 sftp://%HOSTIP:%SSHPORT%POSIX_PWD/log/test2004.txt file://localhost/%PWD/log/test2004.txt scp://%HOSTIP:%SSHPORT%POSIX_PWD/log/test2004.txt file://localhost/%PWD/log/test2004.txt sftp://%HOSTIP:%SSHPORT%POSIX_PWD/log/test2004.txt tftp://%HOSTIP:%TFTPPORT//2004 --insecure
 </command>
 <file name="log/test2004.txt">
 diff --git a/tests/data/test2006 b/tests/data/test2006
 index e25556f..3acbdae 100644
 --- a/tests/data/test2006
 +++ b/tests/data/test2006
@@ -4,6 +4,7 @@
 Metalink
 HTTP
 HTTP GET
 +FILE
 </keywords>
 </info>
@@ -85,6 +86,10 @@ Accept: */*
 Some data delivered from an HTTP resource
 </file1>
 <file2 name="log/heads2006">
 +Content-Length: 496
 +Accept-ranges: bytes
 +
 +
 HTTP/1.1 200 OK
 Date: Thu, 21 Jun 2012 14:49:01 GMT
 Server: test-server/fake
@@ -105,6 +110,9 @@ Metalink: fetching (log/download2006) from (http://%HOSTIP:%HTTPPORT/2006) OK
 Metalink: validating (log/download2006)...
 Metalink: validating (log/download2006) [sha-256] OK
 </file4>
 +<stripfile2>
 +s/Last-Modified:.*//
 +</stripfile2>
 <stripfile4>
 $_ = '' if (($_ !~ /^Metalink: /) && ($_ !~ /error/i) && ($_ !~ /warn/i))
 </stripfile4>
 diff --git a/tests/data/test2007 b/tests/data/test2007
 index cc4bd8c..b169c49 100644
 --- a/tests/data/test2007
 +++ b/tests/data/test2007
@@ -5,6 +5,7 @@ Metalink
 HTTP
 HTTP GET
 -J
 +FILE
 </keywords>
 </info>
@@ -85,7 +86,14 @@ Accept: */*
 <file1 name="log/download2007">
 Something delivered from an HTTP resource
 </file1>
 +<stripfile2>
 +s/Last-Modified:.*//
 +</stripfile2>
 <file2 name="log/heads2007">
 +Content-Length: 496
 +Accept-ranges: bytes
 +
 +
 HTTP/1.1 200 OK
 Date: Thu, 21 Jun 2012 14:50:02 GMT
 Server: test-server/fake
 diff --git a/tests/data/test2008 b/tests/data/test2008
 index 5843792..012f221 100644
 --- a/tests/data/test2008
 +++ b/tests/data/test2008
@@ -4,6 +4,7 @@
 Metalink
 HTTP
 HTTP GET
 +FILE
 </keywords>
 </info>
@@ -77,7 +78,14 @@ Accept: */*
 <file1 name="log/download2008">
 Some stuff delivered from an HTTP resource
 </file1>
 +<stripfile2>
 +s/Last-Modified:.*//
 +</stripfile2>
 <file2 name="log/heads2008">
 +Content-Length: 496
 +Accept-ranges: bytes
 +
 +
 HTTP/1.1 200 OK
 Date: Thu, 21 Jun 2012 15:23:48 GMT
 Server: test-server/fake
 diff --git a/tests/data/test2009 b/tests/data/test2009
 index 84482ce..b0e5c6c 100644
 --- a/tests/data/test2009
 +++ b/tests/data/test2009
@@ -5,6 +5,7 @@ Metalink
 HTTP
 HTTP GET
 -J
 +FILE
 </keywords>
 </info>
@@ -78,7 +79,14 @@ Accept: */*
 <file1 name="log/download2009">
 Some contents delivered from an HTTP resource
 </file1>
 +<stripfile2>
 +s/Last-Modified:.*//
 +</stripfile2>
 <file2 name="log/heads2009">
 +Content-Length: 496
 +Accept-ranges: bytes
 +
 +
 HTTP/1.1 200 OK
 Date: Thu, 21 Jun 2012 16:27:17 GMT
 Server: test-server/fake
 diff --git a/tests/data/test2010 b/tests/data/test2010
 index 91a83f4..33bb309 100644
 --- a/tests/data/test2010
 +++ b/tests/data/test2010
@@ -4,6 +4,7 @@
 Metalink
 HTTP
 HTTP GET
 +FILE
 </keywords>
 </info>
@@ -77,7 +78,14 @@ Accept: */*
 <file1 name="log/download2010">
 Contents delivered from an HTTP resource
 </file1>
 +<stripfile2>
 +s/Last-Modified:.*//
 +</stripfile2>
 <file2 name="log/heads2010">
 +Content-Length: 496
 +Accept-ranges: bytes
 +
 +
 HTTP/1.1 200 OK
 Date: Thu, 21 Jun 2012 17:37:27 GMT
 Server: test-server/fake
 diff --git a/tests/data/test202 b/tests/data/test202
 index f863ec5..0b324b1 100644
 --- a/tests/data/test202
 +++ b/tests/data/test202
@@ -19,7 +19,7 @@ file
  <name>
 two file:// URLs to stdout
  </name>
 - <command>
 +<command option="no-include">
 file://localhost/%PWD/log/test202.txt FILE://localhost/%PWD/log/test202.txt
 </command>
 <file name="log/test202.txt">
 diff --git a/tests/data/test203 b/tests/data/test203
 index 366cc2c..3938426 100644
 --- a/tests/data/test203
 +++ b/tests/data/test203
@@ -24,7 +24,7 @@ file
  <name>
 file:/path URL with a single slash
  </name>
 - <command>
 +<command option="no-include">
 file:%PWD/log/test203.txt
 </command>
 <file name="log/test203.txt">
 diff --git a/tests/data/test204 b/tests/data/test204
 index 9cc7b01..0ed9451 100644
 --- a/tests/data/test204
 +++ b/tests/data/test204
@@ -15,7 +15,7 @@ file
  <name>
 "upload" with file://
  </name>
 - <command>
 +<command option="no-include">
 file://localhost/%PWD/log/result204.txt -T log/upload204.txt
 </command>
 <file name="log/upload204.txt">
 diff --git a/tests/data/test205 b/tests/data/test205
 index 4af93f6..f83c531 100644
 --- a/tests/data/test205
 +++ b/tests/data/test205
@@ -16,7 +16,7 @@ file
  <name>
 "upload" with file://
  </name>
 - <command>
 +<command option="no-include">
 file://localhost/%PWD/log/nonexisting/result205.txt -T log/upload205.txt
 </command>
 <file name="log/upload205.txt">
 diff --git a/tests/data/test2070 b/tests/data/test2070
 index bc3898a..655cd8a 100644
 --- a/tests/data/test2070
 +++ b/tests/data/test2070
@@ -23,7 +23,7 @@ file
  <name>
 basic file:// file with no authority
  </name>
 - <command>
 +<command option="no-include">
 file:%PWD/log/test2070.txt
 </command>
 <file name="log/test2070.txt">
 diff --git a/tests/data/test2071 b/tests/data/test2071
 index 997dfff..eddfa4d 100644
 --- a/tests/data/test2071
 +++ b/tests/data/test2071
@@ -23,7 +23,7 @@ file
  <name>
 basic file:// file with "127.0.0.1" hostname
  </name>
 - <command>
 +<command option="no-include">
 file://127.0.0.1/%PWD/log/test2070.txt
 </command>
 <file name="log/test2070.txt">
 diff --git a/tests/data/test2072 b/tests/data/test2072
 index cd26f22..1bab158 100644
 --- a/tests/data/test2072
 +++ b/tests/data/test2072
@@ -23,7 +23,7 @@ file
 <name>
 file:// with unix path resolution behavior for the case of extra slashes
 </name>
 -<command>
 +<command option="no-include">
 file:////%PWD/log/test2072.txt
 </command>
 <precheck>
 diff --git a/tests/data/test210 b/tests/data/test210
 index e904567..c6fb703 100644
 --- a/tests/data/test210
 +++ b/tests/data/test210
@@ -22,7 +22,7 @@ ftp
  <name>
 Get two FTP files from the same remote dir: no second CWD
  </name>
 - <command>
 +<command option="no-include">
 ftp://%HOSTIP:%FTPPORT/a/path/210 ftp://%HOSTIP:%FTPPORT/a/path/210
 </command>
 <stdout>
 diff --git a/tests/data/test231 b/tests/data/test231
 index 6994957..3d4bc77 100644
 --- a/tests/data/test231
 +++ b/tests/data/test231
@@ -22,7 +22,7 @@ file
  <name>
 file:// with resume
  </name>
 - <command>
 +<command option="no-include">
 file://localhost/%PWD/log/test231.txt -C 10
 </command>
 <file name="log/test231.txt">
 diff --git a/tests/data/test288 b/tests/data/test288
 index ff4db6a..9f8f6e1 100644
 --- a/tests/data/test288
 +++ b/tests/data/test288
@@ -30,7 +30,7 @@ file:// with (unsupported) proxy, authentication and range
 <setenv>
 all_proxy=http://fake:user@%HOSTIP:%HTTPPORT/
 </setenv>
 - <command>
 +<command option="no-include">
 file://localhost/%PWD/log/test288.txt
 </command>
 <file name="log/test288.txt">
 -- 
 2.30.2
--- a/SOURCES/0030-curl-7.76.1-CVE-2023-38545.patch
+++ b/SOURCES/0030-curl-7.76.1-CVE-2023-38545.patch
@ -1,136 +0,0 @@
 From 1d66562c67fc0099d0fd882c693e51dd0b10c45c Mon Sep 17 00:00:00 2001
 From: Jay Satiro <raysatiro@yahoo.com>
 Date: Sat, 30 Sep 2023 03:40:02 -0400
 Subject: [PATCH] socks: return error if hostname too long for remote resolve
 Prior to this change the state machine attempted to change the remote
 resolve to a local resolve if the hostname was longer than 255
 characters. Unfortunately that did not work as intended and caused a
 security issue.
 Name resolvers cannot resolve hostnames longer than 255 characters.
 Bug: https://curl.se/docs/CVE-2023-38545.html
 ---
 lib/socks.c             |  8 +++---
 tests/data/Makefile.inc |  2 +-
 tests/data/test728      | 64 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 69 insertions(+), 5 deletions(-)
 create mode 100644 tests/data/test728
 diff --git a/lib/socks.c b/lib/socks.c
 index c492d663c..a7b5ab07e 100644
 --- a/lib/socks.c
 +++ b/lib/socks.c
@@ -531,13 +531,13 @@ CURLproxycode Curl_SOCKS5(const char *proxy_user,
       infof(data, "SOCKS5: connecting to HTTP proxy %s port %d\n",
             hostname, remote_port);
     /* RFC1928 chapter 5 specifies max 255 chars for domain name in packet */
     if(!socks5_resolve_local && hostname_len > 255) {
 -      infof(data, "SOCKS5: server resolving disabled for hostnames of "
 -            "length > 255 [actual len=%zu]\n", hostname_len);
 -      socks5_resolve_local = TRUE;
 +      failf(data, "SOCKS5: the destination hostname is too long to be "
 +            "resolved remotely by the proxy.");
 +      return CURLPX_LONG_HOSTNAME;
     }
     if(auth & ~(CURLAUTH_BASIC | CURLAUTH_GSSAPI))
       infof(data,
             "warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %lu\n",
@@ -855,7 +855,7 @@ CONNECT_RESOLVE_REMOTE:
     if(!socks5_resolve_local) {
       socksreq[len++] = 3; /* ATYP: domain name = 3 */
 -      socksreq[len++] = (char) hostname_len; /* one byte address length */
 +      socksreq[len++] = (unsigned char) hostname_len; /* one byte length */
       memcpy(&socksreq[len], hostname, hostname_len); /* address w/o NULL */
       len += hostname_len;
       infof(data, "SOCKS5 connect to %s:%d (remotely resolved)\n",
 diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
 index 081e344d4..62ee53578 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
@@ -99,7 +99,7 @@ test672 test673 test674 test675 test676 test677 test678 test679 test680 \
 \
 test700 test701 test702 test703 test704 test705 test706 test707 test708 \
 test709 test710 test711 test712 test713 test714 test715 test716 test717 \
 -test718 \
 +test718 test728 \
 \
 test800 test801 test802 test803 test804 test805 test806 test807 test808 \
 test809 test810 test811 test812 test813 test814 test815 test816 test817 \
 diff --git a/tests/data/test728 b/tests/data/test728
 new file mode 100644
 index 000000000..05bcf2883
 --- /dev/null
 +++ b/tests/data/test728
@@ -0,0 +1,64 @@
 +<testcase>
 +<info>
 +<keywords>
 +HTTP
 +HTTP GET
 +SOCKS5
 +SOCKS5h
 +followlocation
 +</keywords>
 +</info>
 +
 +#
 +# Server-side
 +<reply>
 +# The hostname in this redirect is 256 characters and too long (> 255) for
 +# SOCKS5 remote resolve. curl must return error CURLE_PROXY in this case.
 +<data>
 +HTTP/1.1 301 Moved Permanently
 +Location: http://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/
 +Content-Length: 0
 +Connection: close
 +
 +</data>
 +</reply>
 +
 +#
 +# Client-side
 +<client>
 +<features>
 +proxy
 +</features>
 +<server>
 +http
 +socks5
 +</server>
 + <name>
 +SOCKS5h with HTTP redirect to hostname too long
 + </name>
 + <command>
 +--no-progress-meter --location --proxy socks5h://%HOSTIP:%SOCKSPORT http://%HOSTIP:%HTTPPORT/%TESTNUMBER
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<protocol crlf="yes">
 +GET /%TESTNUMBER HTTP/1.1
 +Host: %HOSTIP:%HTTPPORT
 +User-Agent: curl/%VERSION
 +Accept: */*
 +
 +</protocol>
 +<errorcode>
 +97
 +</errorcode>
 +# the error message is verified because error code CURLE_PROXY (97) may be
 +# returned for any number of reasons and we need to make sure it is
 +# specifically for the reason below so that we know the check is working.
 +<stderr mode="text">
 +curl: (97) SOCKS5: the destination hostname is too long to be resolved remotely by the proxy.
 +</stderr>
 +</verify>
 +</testcase>
 -- 
 2.42.0
--- a/SOURCES/0031-curl-7.61.1-CVE-2021-22924.patch
+++ b/SOURCES/0031-curl-7.61.1-CVE-2021-22924.patch
@ -0,0 +1,662 @@
 From 74ba80e293eb2521d28916b24c3be59b3baf688a Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 18 Feb 2021 10:13:56 +0100
 Subject: [PATCH 1/2] urldata: remove the _ORIG suffix from string names
 It doesn't provide any useful info but only makes the names longer.
 Closes #6624
 Upstream-commit: 70472a44deaff387cf8c8c197e04f3add2a96e2e
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/setopt.c         | 32 ++++++++++++++++----------------
 lib/url.c            | 32 ++++++++++++++++----------------
 lib/urldata.h        | 28 ++++++++++++++--------------
 lib/vtls/cyassl.c    |  2 +-
 lib/vtls/darwinssl.c |  4 ++--
 lib/vtls/gskit.c     |  2 +-
 lib/vtls/gtls.c      |  2 +-
 lib/vtls/mbedtls.c   |  2 +-
 lib/vtls/nss.c       |  2 +-
 lib/vtls/openssl.c   |  2 +-
 lib/vtls/polarssl.c  |  2 +-
 lib/vtls/schannel.c  |  2 +-
 12 files changed, 56 insertions(+), 56 deletions(-)
 diff --git a/lib/setopt.c b/lib/setopt.c
 index 4f04962..b07ccfe 100644
 --- a/lib/setopt.c
 +++ b/lib/setopt.c
@@ -133,7 +133,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
     break;
   case CURLOPT_SSL_CIPHER_LIST:
     /* set a list of cipher we want to use in the SSL connection */
 -    result = Curl_setstropt(&data->set.str[STRING_SSL_CIPHER_LIST_ORIG],
 +    result = Curl_setstropt(&data->set.str[STRING_SSL_CIPHER_LIST],
                             va_arg(param, char *));
     break;
   case CURLOPT_PROXY_SSL_CIPHER_LIST:
@@ -145,7 +145,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
   case CURLOPT_TLS13_CIPHERS:
     if(Curl_ssl_tls13_ciphersuites()) {
       /* set preferred list of TLS 1.3 cipher suites */
 -      result = Curl_setstropt(&data->set.str[STRING_SSL_CIPHER13_LIST_ORIG],
 +      result = Curl_setstropt(&data->set.str[STRING_SSL_CIPHER13_LIST],
                               va_arg(param, char *));
     }
     else
@@ -1532,7 +1532,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
     /*
      * String that holds file name of the SSL certificate to use
      */
 -    result = Curl_setstropt(&data->set.str[STRING_CERT_ORIG],
 +    result = Curl_setstropt(&data->set.str[STRING_CERT],
                             va_arg(param, char *));
     break;
   case CURLOPT_PROXY_SSLCERT:
@@ -1546,7 +1546,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
     /*
      * String that holds file type of the SSL certificate to use
      */
 -    result = Curl_setstropt(&data->set.str[STRING_CERT_TYPE_ORIG],
 +    result = Curl_setstropt(&data->set.str[STRING_CERT_TYPE],
                             va_arg(param, char *));
     break;
   case CURLOPT_PROXY_SSLCERTTYPE:
@@ -1560,7 +1560,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
     /*
      * String that holds file name of the SSL key to use
      */
 -    result = Curl_setstropt(&data->set.str[STRING_KEY_ORIG],
 +    result = Curl_setstropt(&data->set.str[STRING_KEY],
                             va_arg(param, char *));
     break;
   case CURLOPT_PROXY_SSLKEY:
@@ -1574,7 +1574,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
     /*
      * String that holds file type of the SSL key to use
      */
 -    result = Curl_setstropt(&data->set.str[STRING_KEY_TYPE_ORIG],
 +    result = Curl_setstropt(&data->set.str[STRING_KEY_TYPE],
                             va_arg(param, char *));
     break;
   case CURLOPT_PROXY_SSLKEYTYPE:
@@ -1588,7 +1588,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
     /*
      * String that holds the SSL or SSH private key password.
      */
 -    result = Curl_setstropt(&data->set.str[STRING_KEY_PASSWD_ORIG],
 +    result = Curl_setstropt(&data->set.str[STRING_KEY_PASSWD],
                             va_arg(param, char *));
     break;
   case CURLOPT_PROXY_KEYPASSWD:
@@ -1815,7 +1815,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
      */
 #ifdef USE_SSL
     if(Curl_ssl->supports & SSLSUPP_PINNEDPUBKEY)
 -      result = Curl_setstropt(&data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG],
 +      result = Curl_setstropt(&data->set.str[STRING_SSL_PINNEDPUBLICKEY],
                               va_arg(param, char *));
     else
 #endif
@@ -1838,7 +1838,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
     /*
      * Set CA info for SSL connection. Specify file name of the CA certificate
      */
 -    result = Curl_setstropt(&data->set.str[STRING_SSL_CAFILE_ORIG],
 +    result = Curl_setstropt(&data->set.str[STRING_SSL_CAFILE],
                             va_arg(param, char *));
     break;
   case CURLOPT_PROXY_CAINFO:
@@ -1857,7 +1857,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
 #ifdef USE_SSL
     if(Curl_ssl->supports & SSLSUPP_CA_PATH)
       /* This does not work on windows. */
 -      result = Curl_setstropt(&data->set.str[STRING_SSL_CAPATH_ORIG],
 +      result = Curl_setstropt(&data->set.str[STRING_SSL_CAPATH],
                               va_arg(param, char *));
     else
 #endif
@@ -1882,7 +1882,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
      * Set CRL file info for SSL connection. Specify file name of the CRL
      * to check certificates revocation
      */
 -    result = Curl_setstropt(&data->set.str[STRING_SSL_CRLFILE_ORIG],
 +    result = Curl_setstropt(&data->set.str[STRING_SSL_CRLFILE],
                             va_arg(param, char *));
     break;
   case CURLOPT_PROXY_CRLFILE:
@@ -1898,7 +1898,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
      * Set Issuer certificate file
      * to check certificates issuer
      */
 -    result = Curl_setstropt(&data->set.str[STRING_SSL_ISSUERCERT_ORIG],
 +    result = Curl_setstropt(&data->set.str[STRING_SSL_ISSUERCERT],
                             va_arg(param, char *));
     break;
   case CURLOPT_TELNETOPTIONS:
@@ -2449,9 +2449,9 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
     break;
 #ifdef USE_TLS_SRP
   case CURLOPT_TLSAUTH_USERNAME:
 -    result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_USERNAME_ORIG],
 +    result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_USERNAME],
                             va_arg(param, char *));
 -    if(data->set.str[STRING_TLSAUTH_USERNAME_ORIG] && !data->set.ssl.authtype)
 +    if(data->set.str[STRING_TLSAUTH_USERNAME] && !data->set.ssl.authtype)
       data->set.ssl.authtype = CURL_TLSAUTH_SRP; /* default to SRP */
     break;
   case CURLOPT_PROXY_TLSAUTH_USERNAME:
@@ -2462,9 +2462,9 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
       data->set.proxy_ssl.authtype = CURL_TLSAUTH_SRP; /* default to SRP */
     break;
   case CURLOPT_TLSAUTH_PASSWORD:
 -    result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_PASSWORD_ORIG],
 +    result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_PASSWORD],
                             va_arg(param, char *));
 -    if(data->set.str[STRING_TLSAUTH_USERNAME_ORIG] && !data->set.ssl.authtype)
 +    if(data->set.str[STRING_TLSAUTH_USERNAME] && !data->set.ssl.authtype)
       data->set.ssl.authtype = CURL_TLSAUTH_SRP; /* default to SRP */
     break;
   case CURLOPT_PROXY_TLSAUTH_PASSWORD:
 diff --git a/lib/url.c b/lib/url.c
 index bb9d107..a6bc012 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -496,7 +496,7 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
    */
   if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
 #if defined(CURL_CA_BUNDLE)
 -    result = Curl_setstropt(&set->str[STRING_SSL_CAFILE_ORIG], CURL_CA_BUNDLE);
 +    result = Curl_setstropt(&set->str[STRING_SSL_CAFILE], CURL_CA_BUNDLE);
     if(result)
       return result;
@@ -506,7 +506,7 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
       return result;
 #endif
 #if defined(CURL_CA_PATH)
 -    result = Curl_setstropt(&set->str[STRING_SSL_CAPATH_ORIG], CURL_CA_PATH);
 +    result = Curl_setstropt(&set->str[STRING_SSL_CAPATH], CURL_CA_PATH);
     if(result)
       return result;
@@ -4333,9 +4333,9 @@ static CURLcode create_conn(struct Curl_easy *data,
      that will be freed as part of the Curl_easy struct, but all cloned
      copies will be separately allocated.
   */
 -  data->set.ssl.primary.CApath = data->set.str[STRING_SSL_CAPATH_ORIG];
 +  data->set.ssl.primary.CApath = data->set.str[STRING_SSL_CAPATH];
   data->set.proxy_ssl.primary.CApath = data->set.str[STRING_SSL_CAPATH_PROXY];
 -  data->set.ssl.primary.CAfile = data->set.str[STRING_SSL_CAFILE_ORIG];
 +  data->set.ssl.primary.CAfile = data->set.str[STRING_SSL_CAFILE];
   data->set.proxy_ssl.primary.CAfile = data->set.str[STRING_SSL_CAFILE_PROXY];
   data->set.ssl.primary.random_file = data->set.str[STRING_SSL_RANDOM_FILE];
   data->set.proxy_ssl.primary.random_file =
@@ -4343,34 +4343,34 @@ static CURLcode create_conn(struct Curl_easy *data,
   data->set.ssl.primary.egdsocket = data->set.str[STRING_SSL_EGDSOCKET];
   data->set.proxy_ssl.primary.egdsocket = data->set.str[STRING_SSL_EGDSOCKET];
   data->set.ssl.primary.cipher_list =
 -    data->set.str[STRING_SSL_CIPHER_LIST_ORIG];
 +    data->set.str[STRING_SSL_CIPHER_LIST];
   data->set.proxy_ssl.primary.cipher_list =
     data->set.str[STRING_SSL_CIPHER_LIST_PROXY];
   data->set.ssl.primary.cipher_list13 =
 -    data->set.str[STRING_SSL_CIPHER13_LIST_ORIG];
 +    data->set.str[STRING_SSL_CIPHER13_LIST];
   data->set.proxy_ssl.primary.cipher_list13 =
     data->set.str[STRING_SSL_CIPHER13_LIST_PROXY];
 -  data->set.ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE_ORIG];
 +  data->set.ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE];
   data->set.proxy_ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE_PROXY];
 -  data->set.ssl.issuercert = data->set.str[STRING_SSL_ISSUERCERT_ORIG];
 +  data->set.ssl.issuercert = data->set.str[STRING_SSL_ISSUERCERT];
   data->set.proxy_ssl.issuercert = data->set.str[STRING_SSL_ISSUERCERT_PROXY];
 -  data->set.ssl.cert = data->set.str[STRING_CERT_ORIG];
 +  data->set.ssl.cert = data->set.str[STRING_CERT];
   data->set.proxy_ssl.cert = data->set.str[STRING_CERT_PROXY];
 -  data->set.ssl.cert_type = data->set.str[STRING_CERT_TYPE_ORIG];
 +  data->set.ssl.cert_type = data->set.str[STRING_CERT_TYPE];
   data->set.proxy_ssl.cert_type = data->set.str[STRING_CERT_TYPE_PROXY];
 -  data->set.ssl.key = data->set.str[STRING_KEY_ORIG];
 +  data->set.ssl.key = data->set.str[STRING_KEY];
   data->set.proxy_ssl.key = data->set.str[STRING_KEY_PROXY];
 -  data->set.ssl.key_type = data->set.str[STRING_KEY_TYPE_ORIG];
 +  data->set.ssl.key_type = data->set.str[STRING_KEY_TYPE];
   data->set.proxy_ssl.key_type = data->set.str[STRING_KEY_TYPE_PROXY];
 -  data->set.ssl.key_passwd = data->set.str[STRING_KEY_PASSWD_ORIG];
 +  data->set.ssl.key_passwd = data->set.str[STRING_KEY_PASSWD];
   data->set.proxy_ssl.key_passwd = data->set.str[STRING_KEY_PASSWD_PROXY];
 -  data->set.ssl.primary.clientcert = data->set.str[STRING_CERT_ORIG];
 +  data->set.ssl.primary.clientcert = data->set.str[STRING_CERT];
   data->set.proxy_ssl.primary.clientcert = data->set.str[STRING_CERT_PROXY];
 #ifdef USE_TLS_SRP
 -  data->set.ssl.username = data->set.str[STRING_TLSAUTH_USERNAME_ORIG];
 +  data->set.ssl.username = data->set.str[STRING_TLSAUTH_USERNAME];
   data->set.proxy_ssl.username = data->set.str[STRING_TLSAUTH_USERNAME_PROXY];
 -  data->set.ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD_ORIG];
 +  data->set.ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD];
   data->set.proxy_ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD_PROXY];
 #endif
 diff --git a/lib/urldata.h b/lib/urldata.h
 index c70290a..1f8f364 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -1366,9 +1366,9 @@ struct DynamicStatic {
 struct Curl_multi;    /* declared and used only in multi.c */
 enum dupstring {
 -  STRING_CERT_ORIG,       /* client certificate file name */
 +  STRING_CERT,            /* client certificate file name */
   STRING_CERT_PROXY,      /* client certificate file name */
 -  STRING_CERT_TYPE_ORIG,  /* format for certificate (default: PEM)*/
 +  STRING_CERT_TYPE,       /* format for certificate (default: PEM)*/
   STRING_CERT_TYPE_PROXY, /* format for certificate (default: PEM)*/
   STRING_COOKIE,          /* HTTP cookie string to send */
   STRING_COOKIEJAR,       /* dump all cookies to this file */
@@ -1379,11 +1379,11 @@ enum dupstring {
   STRING_FTP_ACCOUNT,     /* ftp account data */
   STRING_FTP_ALTERNATIVE_TO_USER, /* command to send if USER/PASS fails */
   STRING_FTPPORT,         /* port to send with the FTP PORT command */
 -  STRING_KEY_ORIG,        /* private key file name */
 +  STRING_KEY,             /* private key file name */
   STRING_KEY_PROXY,       /* private key file name */
 -  STRING_KEY_PASSWD_ORIG, /* plain text private key password */
 +  STRING_KEY_PASSWD,      /* plain text private key password */
   STRING_KEY_PASSWD_PROXY, /* plain text private key password */
 -  STRING_KEY_TYPE_ORIG,   /* format for private key (default: PEM) */
 +  STRING_KEY_TYPE,        /* format for private key (default: PEM) */
   STRING_KEY_TYPE_PROXY,  /* format for private key (default: PEM) */
   STRING_KRB_LEVEL,       /* krb security level */
   STRING_NETRC_FILE,      /* if not NULL, use this instead of trying to find
@@ -1393,22 +1393,22 @@ enum dupstring {
   STRING_SET_RANGE,       /* range, if used */
   STRING_SET_REFERER,     /* custom string for the HTTP referer field */
   STRING_SET_URL,         /* what original URL to work on */
 -  STRING_SSL_CAPATH_ORIG, /* CA directory name (doesn't work on windows) */
 +  STRING_SSL_CAPATH,      /* CA directory name (doesn't work on windows) */
   STRING_SSL_CAPATH_PROXY, /* CA directory name (doesn't work on windows) */
 -  STRING_SSL_CAFILE_ORIG, /* certificate file to verify peer against */
 +  STRING_SSL_CAFILE,      /* certificate file to verify peer against */
   STRING_SSL_CAFILE_PROXY, /* certificate file to verify peer against */
 -  STRING_SSL_PINNEDPUBLICKEY_ORIG, /* public key file to verify peer against */
 +  STRING_SSL_PINNEDPUBLICKEY, /* public key file to verify peer against */
   STRING_SSL_PINNEDPUBLICKEY_PROXY, /* public key file to verify proxy */
 -  STRING_SSL_CIPHER_LIST_ORIG, /* list of ciphers to use */
 +  STRING_SSL_CIPHER_LIST, /* list of ciphers to use */
   STRING_SSL_CIPHER_LIST_PROXY, /* list of ciphers to use */
 -  STRING_SSL_CIPHER13_LIST_ORIG, /* list of TLS 1.3 ciphers to use */
 +  STRING_SSL_CIPHER13_LIST, /* list of TLS 1.3 ciphers to use */
   STRING_SSL_CIPHER13_LIST_PROXY, /* list of TLS 1.3 ciphers to use */
   STRING_SSL_EGDSOCKET,   /* path to file containing the EGD daemon socket */
   STRING_SSL_RANDOM_FILE, /* path to file containing "random" data */
   STRING_USERAGENT,       /* User-Agent string */
 -  STRING_SSL_CRLFILE_ORIG, /* crl file to check certificate */
 +  STRING_SSL_CRLFILE,     /* crl file to check certificate */
   STRING_SSL_CRLFILE_PROXY, /* crl file to check certificate */
 -  STRING_SSL_ISSUERCERT_ORIG, /* issuer cert file to check certificate */
 +  STRING_SSL_ISSUERCERT, /* issuer cert file to check certificate */
   STRING_SSL_ISSUERCERT_PROXY, /* issuer cert file to check certificate */
   STRING_SSL_ENGINE,      /* name of ssl engine */
   STRING_USERNAME,        /* <username>, if used */
@@ -1433,9 +1433,9 @@ enum dupstring {
   STRING_MAIL_AUTH,
 #ifdef USE_TLS_SRP
 -  STRING_TLSAUTH_USERNAME_ORIG,  /* TLS auth <username> */
 +  STRING_TLSAUTH_USERNAME,  /* TLS auth <username> */
   STRING_TLSAUTH_USERNAME_PROXY, /* TLS auth <username> */
 -  STRING_TLSAUTH_PASSWORD_ORIG,  /* TLS auth <password> */
 +  STRING_TLSAUTH_PASSWORD,  /* TLS auth <password> */
   STRING_TLSAUTH_PASSWORD_PROXY, /* TLS auth <password> */
 #endif
   STRING_BEARER,                /* <bearer>, if used */
 diff --git a/lib/vtls/cyassl.c b/lib/vtls/cyassl.c
 index e10398a..ffd116d 100644
 --- a/lib/vtls/cyassl.c
 +++ b/lib/vtls/cyassl.c
@@ -474,7 +474,7 @@ cyassl_connect_step2(struct connectdata *conn,
     conn->http_proxy.host.dispname : conn->host.dispname;
   const char * const pinnedpubkey = SSL_IS_PROXY() ?
                         data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
 -                        data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG];
 +                        data->set.str[STRING_SSL_PINNEDPUBLICKEY];
   conn->recv[sockindex] = cyassl_recv;
   conn->send[sockindex] = cyassl_send;
 diff --git a/lib/vtls/darwinssl.c b/lib/vtls/darwinssl.c
 index 1aea0dc..572e8bf 100644
 --- a/lib/vtls/darwinssl.c
 +++ b/lib/vtls/darwinssl.c
@@ -2449,9 +2449,9 @@ darwinssl_connect_step2(struct connectdata *conn, int sockindex)
     connssl->connecting_state = ssl_connect_3;
 #ifdef DARWIN_SSL_PINNEDPUBKEY
 -    if(data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG]) {
 +    if(data->set.str[STRING_SSL_PINNEDPUBLICKEY]) {
       CURLcode result = pkp_pin_peer_pubkey(data, BACKEND->ssl_ctx,
 -                            data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG]);
 +                            data->set.str[STRING_SSL_PINNEDPUBLICKEY]);
       if(result) {
         failf(data, "SSL: public key does not match pinned public key!");
         return result;
 diff --git a/lib/vtls/gskit.c b/lib/vtls/gskit.c
 index a0b4960..b4c7b8a 100644
 --- a/lib/vtls/gskit.c
 +++ b/lib/vtls/gskit.c
@@ -1136,7 +1136,7 @@ static CURLcode gskit_connect_step3(struct connectdata *conn, int sockindex)
   /* Check pinned public key. */
   ptr = SSL_IS_PROXY() ? data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
 -                         data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG];
 +    data->set.str[STRING_SSL_PINNEDPUBLICKEY];
   if(!result && ptr) {
     curl_X509certificate x509;
     curl_asn1Element *p;
 diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
 index 207b0fd..c5eb948 100644
 --- a/lib/vtls/gtls.c
 +++ b/lib/vtls/gtls.c
@@ -1329,7 +1329,7 @@ gtls_connect_step3(struct connectdata *conn,
   }
   ptr = SSL_IS_PROXY() ? data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
 -        data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG];
 +    data->set.str[STRING_SSL_PINNEDPUBLICKEY];
   if(ptr) {
     result = pkp_pin_peer_pubkey(data, x509_cert, ptr);
     if(result != CURLE_OK) {
 diff --git a/lib/vtls/mbedtls.c b/lib/vtls/mbedtls.c
 index d7759dc..48010ae 100644
 --- a/lib/vtls/mbedtls.c
 +++ b/lib/vtls/mbedtls.c
@@ -540,7 +540,7 @@ mbed_connect_step2(struct connectdata *conn,
   const mbedtls_x509_crt *peercert;
   const char * const pinnedpubkey = SSL_IS_PROXY() ?
         data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
 -        data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG];
 +        data->set.str[STRING_SSL_PINNEDPUBLICKEY];
 #ifdef HAS_ALPN
   const char *next_protocol;
 diff --git a/lib/vtls/nss.c b/lib/vtls/nss.c
 index 89f8183..366bf9e 100644
 --- a/lib/vtls/nss.c
 +++ b/lib/vtls/nss.c
@@ -2067,7 +2067,7 @@ static CURLcode nss_do_connect(struct connectdata *conn, int sockindex)
     &data->set.proxy_ssl.certverifyresult : &data->set.ssl.certverifyresult;
   const char * const pinnedpubkey = SSL_IS_PROXY() ?
               data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
 -              data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG];
 +              data->set.str[STRING_SSL_PINNEDPUBLICKEY];
   /* check timeout situation */
 diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
 index 35cd652..8c97c1d 100644
 --- a/lib/vtls/openssl.c
 +++ b/lib/vtls/openssl.c
@@ -3388,7 +3388,7 @@ static CURLcode servercert(struct connectdata *conn,
     result = CURLE_OK;
   ptr = SSL_IS_PROXY() ? data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
 -                         data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG];
 +    data->set.str[STRING_SSL_PINNEDPUBLICKEY];
   if(!result && ptr) {
     result = pkp_pin_peer_pubkey(data, BACKEND->server_cert, ptr);
     if(result)
 diff --git a/lib/vtls/polarssl.c b/lib/vtls/polarssl.c
 index 604cb4c..f284ad1 100644
 --- a/lib/vtls/polarssl.c
 +++ b/lib/vtls/polarssl.c
@@ -459,7 +459,7 @@ polarssl_connect_step2(struct connectdata *conn,
   char buffer[1024];
   const char * const pinnedpubkey = SSL_IS_PROXY() ?
             data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
 -            data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG];
 +            data->set.str[STRING_SSL_PINNEDPUBLICKEY];
   char errorbuf[128];
 diff --git a/lib/vtls/schannel.c b/lib/vtls/schannel.c
 index 8f6c301..95c060b 100644
 --- a/lib/vtls/schannel.c
 +++ b/lib/vtls/schannel.c
@@ -1060,7 +1060,7 @@ schannel_connect_step2(struct connectdata *conn, int sockindex)
   pubkey_ptr = SSL_IS_PROXY() ?
     data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
 -    data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG];
 +    data->set.str[STRING_SSL_PINNEDPUBLICKEY];
   if(pubkey_ptr) {
     result = pkp_pin_peer_pubkey(conn, sockindex, pubkey_ptr);
     if(result) {
 -- 
 2.31.1
 From 040fa4f60f9b809972d51184dfa4980ba44d8b6b Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Sat, 19 Jun 2021 00:42:28 +0200
 Subject: [PATCH 2/2] vtls: fix connection reuse checks for issuer cert and
 case sensitivity
 CVE-2021-22924
 Reported-by: Harry Sintonen
 Bug: https://curl.se/docs/CVE-2021-22924.html
 Upstream-commit: 5ea3145850ebff1dc2b13d17440300a01ca38161
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/url.c          |  5 +++--
 lib/urldata.h      |  2 +-
 lib/vtls/gtls.c    | 10 +++++-----
 lib/vtls/nss.c     |  4 ++--
 lib/vtls/openssl.c | 12 ++++++------
 lib/vtls/vtls.c    | 21 ++++++++++++++++-----
 6 files changed, 33 insertions(+), 21 deletions(-)
 diff --git a/lib/url.c b/lib/url.c
 index a6bc012..4803653 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -4337,6 +4337,9 @@ static CURLcode create_conn(struct Curl_easy *data,
   data->set.proxy_ssl.primary.CApath = data->set.str[STRING_SSL_CAPATH_PROXY];
   data->set.ssl.primary.CAfile = data->set.str[STRING_SSL_CAFILE];
   data->set.proxy_ssl.primary.CAfile = data->set.str[STRING_SSL_CAFILE_PROXY];
 +  data->set.ssl.primary.issuercert = data->set.str[STRING_SSL_ISSUERCERT];
 +  data->set.proxy_ssl.primary.issuercert =
 +    data->set.str[STRING_SSL_ISSUERCERT_PROXY];
   data->set.ssl.primary.random_file = data->set.str[STRING_SSL_RANDOM_FILE];
   data->set.proxy_ssl.primary.random_file =
     data->set.str[STRING_SSL_RANDOM_FILE];
@@ -4353,8 +4356,6 @@ static CURLcode create_conn(struct Curl_easy *data,
   data->set.ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE];
   data->set.proxy_ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE_PROXY];
 -  data->set.ssl.issuercert = data->set.str[STRING_SSL_ISSUERCERT];
 -  data->set.proxy_ssl.issuercert = data->set.str[STRING_SSL_ISSUERCERT_PROXY];
   data->set.ssl.cert = data->set.str[STRING_CERT];
   data->set.proxy_ssl.cert = data->set.str[STRING_CERT_PROXY];
   data->set.ssl.cert_type = data->set.str[STRING_CERT_TYPE];
 diff --git a/lib/urldata.h b/lib/urldata.h
 index 1f8f364..72a36fb 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -223,6 +223,7 @@ struct ssl_primary_config {
   bool sessionid;        /* cache session IDs or not */
   char *CApath;          /* certificate dir (doesn't work on windows) */
   char *CAfile;          /* certificate to verify peer against */
 +  char *issuercert;      /* optional issuer certificate filename */
   char *clientcert;
   char *random_file;     /* path to file containing "random" data */
   char *egdsocket;       /* path to file containing the EGD daemon socket */
@@ -238,7 +239,6 @@ struct ssl_config_data {
   bool no_partialchain;  /* don't accept partial certificate chains */
   long certverifyresult; /* result from the certificate verification */
   char *CRLfile;   /* CRL to check certificate revocation */
 -  char *issuercert;/* optional issuer certificate filename */
   curl_ssl_ctx_callback fsslctx; /* function to initialize ssl ctx */
   void *fsslctxp;        /* parameter for call back */
   bool certinfo;         /* gather lots of certificate info */
 diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
 index c5eb948..0cb59c8 100644
 --- a/lib/vtls/gtls.c
 +++ b/lib/vtls/gtls.c
@@ -1002,7 +1002,7 @@ gtls_connect_step3(struct connectdata *conn,
   if(!chainp) {
     if(SSL_CONN_CONFIG(verifypeer) ||
        SSL_CONN_CONFIG(verifyhost) ||
 -       SSL_SET_OPTION(issuercert)) {
 +       SSL_CONN_CONFIG(issuercert)) {
 #ifdef USE_TLS_SRP
       if(SSL_SET_OPTION(authtype) == CURL_TLSAUTH_SRP
          && SSL_SET_OPTION(username) != NULL
@@ -1184,21 +1184,21 @@ gtls_connect_step3(struct connectdata *conn,
        gnutls_x509_crt_t format */
     gnutls_x509_crt_import(x509_cert, chainp, GNUTLS_X509_FMT_DER);
 -  if(SSL_SET_OPTION(issuercert)) {
 +  if(SSL_CONN_CONFIG(issuercert)) {
     gnutls_x509_crt_init(&x509_issuer);
 -    issuerp = load_file(SSL_SET_OPTION(issuercert));
 +    issuerp = load_file(SSL_CONN_CONFIG(issuercert));
     gnutls_x509_crt_import(x509_issuer, &issuerp, GNUTLS_X509_FMT_PEM);
     rc = gnutls_x509_crt_check_issuer(x509_cert, x509_issuer);
     gnutls_x509_crt_deinit(x509_issuer);
     unload_file(issuerp);
     if(rc <= 0) {
       failf(data, "server certificate issuer check failed (IssuerCert: %s)",
 -            SSL_SET_OPTION(issuercert)?SSL_SET_OPTION(issuercert):"none");
 +            SSL_CONN_CONFIG(issuercert)?SSL_CONN_CONFIG(issuercert):"none");
       gnutls_x509_crt_deinit(x509_cert);
       return CURLE_SSL_ISSUER_ERROR;
     }
     infof(data, "\t server certificate issuer check OK (Issuer Cert: %s)\n",
 -          SSL_SET_OPTION(issuercert)?SSL_SET_OPTION(issuercert):"none");
 +          SSL_CONN_CONFIG(issuercert)?SSL_CONN_CONFIG(issuercert):"none");
   }
   size = sizeof(certbuf);
 diff --git a/lib/vtls/nss.c b/lib/vtls/nss.c
 index 366bf9e..2d9581d 100644
 --- a/lib/vtls/nss.c
 +++ b/lib/vtls/nss.c
@@ -2095,9 +2095,9 @@ static CURLcode nss_do_connect(struct connectdata *conn, int sockindex)
   if(result)
     goto error;
 -  if(SSL_SET_OPTION(issuercert)) {
 +  if(SSL_CONN_CONFIG(issuercert)) {
     SECStatus ret = SECFailure;
 -    char *nickname = dup_nickname(data, SSL_SET_OPTION(issuercert));
 +    char *nickname = dup_nickname(data, SSL_CONN_CONFIG(issuercert));
     if(nickname) {
       /* we support only nicknames in case of issuercert for now */
       ret = check_issuer_cert(BACKEND->handle, nickname);
 diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
 index 8c97c1d..28eaa6d 100644
 --- a/lib/vtls/openssl.c
 +++ b/lib/vtls/openssl.c
@@ -3311,11 +3311,11 @@ static CURLcode servercert(struct connectdata *conn,
        deallocating the certificate. */
     /* e.g. match issuer name with provided issuer certificate */
 -    if(SSL_SET_OPTION(issuercert)) {
 -      if(BIO_read_filename(fp, SSL_SET_OPTION(issuercert)) <= 0) {
 +    if(SSL_CONN_CONFIG(issuercert)) {
 +      if(BIO_read_filename(fp, SSL_CONN_CONFIG(issuercert)) <= 0) {
         if(strict)
           failf(data, "SSL: Unable to open issuer cert (%s)",
 -                SSL_SET_OPTION(issuercert));
 +                SSL_CONN_CONFIG(issuercert));
         BIO_free(fp);
         X509_free(BACKEND->server_cert);
         BACKEND->server_cert = NULL;
@@ -3326,7 +3326,7 @@ static CURLcode servercert(struct connectdata *conn,
       if(!issuer) {
         if(strict)
           failf(data, "SSL: Unable to read issuer cert (%s)",
 -                SSL_SET_OPTION(issuercert));
 +                SSL_CONN_CONFIG(issuercert));
         BIO_free(fp);
         X509_free(issuer);
         X509_free(BACKEND->server_cert);
@@ -3337,7 +3337,7 @@ static CURLcode servercert(struct connectdata *conn,
       if(X509_check_issued(issuer, BACKEND->server_cert) != X509_V_OK) {
         if(strict)
           failf(data, "SSL: Certificate issuer check failed (%s)",
 -                SSL_SET_OPTION(issuercert));
 +                SSL_CONN_CONFIG(issuercert));
         BIO_free(fp);
         X509_free(issuer);
         X509_free(BACKEND->server_cert);
@@ -3346,7 +3346,7 @@ static CURLcode servercert(struct connectdata *conn,
       }
       infof(data, " SSL certificate issuer check ok (%s)\n",
 -            SSL_SET_OPTION(issuercert));
 +            SSL_CONN_CONFIG(issuercert));
       X509_free(issuer);
     }
 diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
 index b61c640..18672a5 100644
 --- a/lib/vtls/vtls.c
 +++ b/lib/vtls/vtls.c
@@ -82,6 +82,15 @@
   else                                       \
     dest->var = NULL;
 +static bool safecmp(char *a, char *b)
 +{
 +  if(a && b)
 +    return !strcmp(a, b);
 +  else if(!a && !b)
 +    return TRUE; /* match */
 +  return FALSE; /* no match */
 +}
 +
 bool
 Curl_ssl_config_matches(struct ssl_primary_config* data,
                         struct ssl_primary_config* needle)
@@ -91,11 +100,11 @@ Curl_ssl_config_matches(struct ssl_primary_config* data,
      (data->verifypeer == needle->verifypeer) &&
      (data->verifyhost == needle->verifyhost) &&
      (data->verifystatus == needle->verifystatus) &&
 -     Curl_safe_strcasecompare(data->CApath, needle->CApath) &&
 -     Curl_safe_strcasecompare(data->CAfile, needle->CAfile) &&
 -     Curl_safe_strcasecompare(data->clientcert, needle->clientcert) &&
 -     Curl_safe_strcasecompare(data->random_file, needle->random_file) &&
 -     Curl_safe_strcasecompare(data->egdsocket, needle->egdsocket) &&
 +     safecmp(data->CApath, needle->CApath) &&
 +     safecmp(data->CAfile, needle->CAfile) &&
 +     safecmp(data->clientcert, needle->clientcert) &&
 +     safecmp(data->random_file, needle->random_file) &&
 +     safecmp(data->egdsocket, needle->egdsocket) &&
      Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) &&
      Curl_safe_strcasecompare(data->cipher_list13, needle->cipher_list13))
     return TRUE;
@@ -116,6 +125,7 @@ Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
   CLONE_STRING(CApath);
   CLONE_STRING(CAfile);
 +  CLONE_STRING(issuercert);
   CLONE_STRING(clientcert);
   CLONE_STRING(random_file);
   CLONE_STRING(egdsocket);
@@ -129,6 +139,7 @@ void Curl_free_primary_ssl_config(struct ssl_primary_config* sslc)
 {
   Curl_safefree(sslc->CApath);
   Curl_safefree(sslc->CAfile);
 +  Curl_safefree(sslc->issuercert);
   Curl_safefree(sslc->clientcert);
   Curl_safefree(sslc->random_file);
   Curl_safefree(sslc->egdsocket);
 -- 
 2.31.1
--- a/SOURCES/0032-curl-7.61.1-CVE-2021-22898.patch
+++ b/SOURCES/0032-curl-7.61.1-CVE-2021-22898.patch
@ -1,4 +1,4 @@
-From 886f7458bbf005299f3f8224103d1903cd6fa7a4 Mon Sep 17 00:00:00 2001
+From ae2dc830fb37e9243dbdaf8b92e41df91f43b3f2 Mon Sep 17 00:00:00 2001
 From: Harry Sintonen <sintonen@iki.fi>
 Date: Fri, 7 May 2021 13:09:57 +0200
 Subject: [PATCH] telnet: check sscanf() for correct number of matches
@ -14,16 +14,16 @@ Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/lib/telnet.c b/lib/telnet.c
-index f96a4cb..4551435 100644
+index 1fc5af1..ea6bc71 100644
 --- a/lib/telnet.c
 +++ b/lib/telnet.c
-@@ -921,7 +921,7 @@ static void suboption(struct Curl_easy *data)
+@@ -967,7 +967,7 @@ static void suboption(struct connectdata *conn)
         size_t tmplen = (strlen(v->data) + 1);
         /* Add the variable only if it fits */
         if(len + tmplen < (int)sizeof(temp)-6) {
 -          if(sscanf(v->data, "%127[^,],%127s", varname, varval)) {
 +          if(sscanf(v->data, "%127[^,],%127s", varname, varval) == 2) {
-             msnprintf((char *)&temp[len], sizeof(temp) - len,
+             snprintf((char *)&temp[len], sizeof(temp) - len,
                      "%c%s%c%s", CURL_NEW_ENV_VAR, varname,
                      CURL_NEW_ENV_VALUE, varval);
 -- 
--- a/SOURCES/0033-curl-7.61.1-CVE-2021-22925.patch
+++ b/SOURCES/0033-curl-7.61.1-CVE-2021-22925.patch
@ -1,4 +1,4 @@
-From 3dbac7fb8b39a4f9aa871401d9d2790f0583ba01 Mon Sep 17 00:00:00 2001
+From 2fbbf282e42ae476459f7efe68a88dcb63dcc43b Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Sat, 12 Jun 2021 18:25:15 +0200
 Subject: [PATCH] telnet: fix option parser to not send uninitialized contents
@ -15,15 +15,15 @@ Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 1 file changed, 11 insertions(+), 6 deletions(-)
 diff --git a/lib/telnet.c b/lib/telnet.c
-index fdd137f..567c22c 100644
+index ea6bc71..f8428b8 100644
 --- a/lib/telnet.c
 +++ b/lib/telnet.c
-@@ -922,12 +922,17 @@ static void suboption(struct Curl_easy *data)
+@@ -967,12 +967,17 @@ static void suboption(struct connectdata *conn)
         size_t tmplen = (strlen(v->data) + 1);
         /* Add the variable only if it fits */
         if(len + tmplen < (int)sizeof(temp)-6) {
 -          if(sscanf(v->data, "%127[^,],%127s", varname, varval) == 2) {
-            msnprintf((char *)&temp[len], sizeof(temp) - len,
+-            snprintf((char *)&temp[len], sizeof(temp) - len,
 -                     "%c%s%c%s", CURL_NEW_ENV_VAR, varname,
 -                     CURL_NEW_ENV_VALUE, varval);
 -            len += tmplen;
@ -33,15 +33,15 @@ index fdd137f..567c22c 100644
 +          varval[0] = 0;
 +          rv = sscanf(v->data, "%127[^,]%1[,]%127s", varname, sep, varval);
 +          if(rv == 1)
-+            len += msnprintf((char *)&temp[len], sizeof(temp) - len,
+            len += snprintf((char *)&temp[len], sizeof(temp) - len,
 +                            "%c%s", CURL_NEW_ENV_VAR, varname);
 +          else if(rv >= 2)
-+            len += msnprintf((char *)&temp[len], sizeof(temp) - len,
+            len += snprintf((char *)&temp[len], sizeof(temp) - len,
 +                            "%c%s%c%s", CURL_NEW_ENV_VAR, varname,
 +                            CURL_NEW_ENV_VALUE, varval);
         }
       }
-       msnprintf((char *)&temp[len], sizeof(temp) - len,
+       snprintf((char *)&temp[len], sizeof(temp) - len,
 -- 
 2.31.1
--- a/SOURCES/0034-curl-7.61.1-CVE-2021-22946.patch
+++ b/SOURCES/0034-curl-7.61.1-CVE-2021-22946.patch
@ -1,4 +1,4 @@
-From 64f8bdbf7da9e6b65716ce0d020c6c01d0aba77d Mon Sep 17 00:00:00 2001
+From 03ca8c6faca7de6628f9cbec3001ec6466c88d07 Mon Sep 17 00:00:00 2001
 From: Patrick Monnerat <patrick@monnerat.net>
 Date: Wed, 8 Sep 2021 11:56:22 +0200
 Subject: [PATCH] ftp,imap,pop3: do not ignore --ssl-reqd
@ -29,30 +29,30 @@ Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 create mode 100644 tests/data/test986
 diff --git a/lib/ftp.c b/lib/ftp.c
-index 5ef1e2e..71f998e 100644
+index 71c9642..30ebeaa 100644
 --- a/lib/ftp.c
 +++ b/lib/ftp.c
-@@ -2678,9 +2678,12 @@ static CURLcode ftp_statemachine(struct Curl_easy *data,
+@@ -2621,9 +2621,12 @@ static CURLcode ftp_statemach_act(struct connectdata *conn)
     /* we have now received a full FTP server response */
     switch(ftpc->state) {
     case FTP_WAIT220:
 -      if(ftpcode == 230)
 -        /* 230 User logged in - already! */
-        return ftp_state_user_resp(data, ftpcode, ftpc->state);
+-        return ftp_state_user_resp(conn, ftpcode, ftpc->state);
 +      if(ftpcode == 230) {
 +        /* 230 User logged in - already! Take as 220 if TLS required. */
 +        if(data->set.use_ssl <= CURLUSESSL_TRY ||
-+           conn->bits.ftp_use_control_ssl)
+           conn->ssl[FIRSTSOCKET].use)
-+          return ftp_state_user_resp(data, ftpcode, ftpc->state);
+          return ftp_state_user_resp(conn, ftpcode, ftpc->state);
 +      }
       else if(ftpcode != 220) {
         failf(data, "Got a %03d ftp-server response when 220 was expected",
               ftpcode);
 diff --git a/lib/imap.c b/lib/imap.c
-index e50d7fd..feb7445 100644
+index bda23a5..7e159d4 100644
 --- a/lib/imap.c
 +++ b/lib/imap.c
-@@ -935,22 +935,18 @@ static CURLcode imap_state_capability_resp(struct Curl_easy *data,
+@@ -910,22 +910,18 @@ static CURLcode imap_state_capability_resp(struct connectdata *conn,
       line += wordlen;
     }
   }
@ -61,10 +61,10 @@ index e50d7fd..feb7445 100644
 -      /* We don't have a SSL/TLS connection yet, but SSL is requested */
 -      if(imapc->tls_supported)
 -        /* Switch to TLS connection now */
-        result = imap_perform_starttls(data, conn);
+-        result = imap_perform_starttls(conn);
 -      else if(data->set.use_ssl == CURLUSESSL_TRY)
 -        /* Fallback and carry on with authentication */
-        result = imap_perform_authentication(data, conn);
+-        result = imap_perform_authentication(conn);
 -      else {
 -        failf(data, "STARTTLS not supported.");
 -        result = CURLE_USE_SSL_FAILED;
@ -73,23 +73,23 @@ index e50d7fd..feb7445 100644
 +    /* PREAUTH is not compatible with STARTTLS. */
 +    if(imapcode == IMAP_RESP_OK && imapc->tls_supported && !imapc->preauth) {
 +      /* Switch to TLS connection now */
-+      result = imap_perform_starttls(data, conn);
+      result = imap_perform_starttls(conn);
     }
 -    else
 +    else if(data->set.use_ssl <= CURLUSESSL_TRY)
-       result = imap_perform_authentication(data, conn);
+       result = imap_perform_authentication(conn);
 +    else {
 +      failf(data, "STARTTLS not available.");
 +      result = CURLE_USE_SSL_FAILED;
 +    }
   }
   else
-     result = imap_perform_authentication(data, conn);
+     result = imap_perform_authentication(conn);
 diff --git a/lib/pop3.c b/lib/pop3.c
-index 6168b12..7698d1c 100644
+index 04cc887..3e916ce 100644
 --- a/lib/pop3.c
 +++ b/lib/pop3.c
-@@ -740,28 +740,23 @@ static CURLcode pop3_state_capa_resp(struct Curl_easy *data, int pop3code,
+@@ -718,28 +718,23 @@ static CURLcode pop3_state_capa_resp(struct connectdata *conn, int pop3code,
       }
     }
   }
@ -98,17 +98,17 @@ index 6168b12..7698d1c 100644
 -      /* We don't have a SSL/TLS connection yet, but SSL is requested */
 -      if(pop3c->tls_supported)
 -        /* Switch to TLS connection now */
-        result = pop3_perform_starttls(data, conn);
+-        result = pop3_perform_starttls(conn);
 -      else if(data->set.use_ssl == CURLUSESSL_TRY)
 -        /* Fallback and carry on with authentication */
-        result = pop3_perform_authentication(data, conn);
+-        result = pop3_perform_authentication(conn);
 -      else {
 -        failf(data, "STLS not supported.");
 -        result = CURLE_USE_SSL_FAILED;
 -      }
 -    }
 -    else
-      result = pop3_perform_authentication(data, conn);
+-      result = pop3_perform_authentication(conn);
 -  }
   else {
     /* Clear text is supported when CAPA isn't recognised */
@ -116,15 +116,15 @@ index 6168b12..7698d1c 100644
 +    if(pop3code != '+')
 +      pop3c->authtypes |= POP3_TYPE_CLEARTEXT;
-    result = pop3_perform_authentication(data, conn);
+-    result = pop3_perform_authentication(conn);
 +    if(!data->set.use_ssl || conn->ssl[FIRSTSOCKET].use)
-+      result = pop3_perform_authentication(data, conn);
+      result = pop3_perform_authentication(conn);
 +    else if(pop3code == '+' && pop3c->tls_supported)
 +      /* Switch to TLS connection now */
-+      result = pop3_perform_starttls(data, conn);
+      result = pop3_perform_starttls(conn);
 +    else if(data->set.use_ssl <= CURLUSESSL_TRY)
 +      /* Fallback and carry on with authentication */
-+      result = pop3_perform_authentication(data, conn);
+      result = pop3_perform_authentication(conn);
 +    else {
 +      failf(data, "STLS not supported.");
 +      result = CURLE_USE_SSL_FAILED;
@ -133,12 +133,12 @@ index 6168b12..7698d1c 100644
   return result;
 diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
-index d083baf..163ce59 100644
+index ef9252b..1ba482b 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
-@@ -117,6 +117,8 @@ test945 test946 test947 test948 test949 test950 test951 test952 test953 \
+@@ -108,6 +108,8 @@ test927 test928 test929 test930 test931 test932 test933 test934 test935 \
- test954 test955 test956 test957 test958 test959 test960 test961 test962 \
+ test936 test937 test938 test939 test940 test941 test942 test943 test944 \
- test963 test964 test965 test966 test967 test968 test969 test970 test971 \
+ test945 test946 test947 test948 test949 test950 test951 test952 \
 \
 +test984 test985 test986 \
 +\
--- a/SOURCES/0035-curl-7.61.1-CVE-2021-22947.patch
+++ b/SOURCES/0035-curl-7.61.1-CVE-2021-22947.patch
@ -37,7 +37,7 @@ diff --git a/lib/ftp.c b/lib/ftp.c
 index 71f998e..e920138 100644
 --- a/lib/ftp.c
 +++ b/lib/ftp.c
-@@ -2740,6 +2740,9 @@ static CURLcode ftp_statemachine(struct Curl_easy *data,
+@@ -2688,6 +2688,9 @@ static CURLcode ftp_statemach_act(struct connectdata *conn)
     case FTP_AUTH:
       /* we have gotten the response to a previous AUTH command */
@ -51,12 +51,12 @@ diff --git a/lib/imap.c b/lib/imap.c
 index feb7445..09bc5d6 100644
 --- a/lib/imap.c
 +++ b/lib/imap.c
-@@ -964,6 +964,10 @@ static CURLcode imap_state_starttls_resp(struct Curl_easy *data,
+@@ -939,6 +939,10 @@ static CURLcode imap_state_starttls_resp(struct connectdata *conn,
   (void)instate; /* no use for this yet */
 +  /* Pipelining in response is forbidden. */
-+  if(data->conn->proto.imapc.pp.cache_size)
+  if(conn->proto.imapc.pp.cache_size)
 +    return CURLE_WEIRD_SERVER_REPLY;
 +
   if(imapcode != IMAP_RESP_OK) {
@ -66,12 +66,12 @@ diff --git a/lib/pop3.c b/lib/pop3.c
 index 7698d1c..dccfced 100644
 --- a/lib/pop3.c
 +++ b/lib/pop3.c
-@@ -771,6 +771,10 @@ static CURLcode pop3_state_starttls_resp(struct Curl_easy *data,
+@@ -750,6 +750,10 @@ static CURLcode pop3_state_starttls_resp(struct connectdata *conn,
-   CURLcode result = CURLE_OK;
+ 
   (void)instate; /* no use for this yet */
 +  /* Pipelining in response is forbidden. */
-+  if(data->conn->proto.pop3c.pp.cache_size)
+  if(conn->proto.pop3c.pp.cache_size)
 +    return CURLE_WEIRD_SERVER_REPLY;
 +
   if(pop3code != '+') {
@ -81,12 +81,12 @@ diff --git a/lib/smtp.c b/lib/smtp.c
 index 1defb25..1f89777 100644
 --- a/lib/smtp.c
 +++ b/lib/smtp.c
-@@ -834,6 +834,10 @@ static CURLcode smtp_state_starttls_resp(struct Curl_easy *data,
+@@ -685,6 +685,10 @@ static CURLcode smtp_state_starttls_resp(struct connectdata *conn,
-   CURLcode result = CURLE_OK;
+ 
   (void)instate; /* no use for this yet */
 +  /* Pipelining in response is forbidden. */
-+  if(data->conn->proto.smtpc.pp.cache_size)
+  if(conn->proto.smtpc.pp.cache_size)
 +    return CURLE_WEIRD_SERVER_REPLY;
 +
   if(smtpcode != 220) {
@ -96,9 +96,9 @@ diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
 index 163ce59..42b0569 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
-@@ -117,7 +117,7 @@ test945 test946 test947 test948 test949 test950 test951 test952 test953 \
+@@ -108,7 +108,7 @@ test927 test928 test929 test930 test931 test932 test933 test934 test935 \
- test954 test955 test956 test957 test958 test959 test960 test961 test962 \
+ test936 test937 test938 test939 test940 test941 test942 test943 test944 \
- test963 test964 test965 test966 test967 test968 test969 test970 test971 \
+ test945 test946 test947 test948 test949 test950 test951 test952 \
 \
 -test984 test985 test986 \
 +test980 test981 test982 test983 test984 test985 test986 \
--- a/SOURCES/0036-curl-7.61.1-CVE-2022-22576.patch
+++ b/SOURCES/0036-curl-7.61.1-CVE-2022-22576.patch
@ -0,0 +1,338 @@
 From 295124c256ed25f097192cfa9a67e460f7bb587f Mon Sep 17 00:00:00 2001
 From: nao <naost3rn@gmail.com>
 Date: Tue, 21 Jan 2020 10:30:37 +0100
 Subject: [PATCH 1/2] http: move "oauth_bearer" from connectdata to Curl_easy
 Fixes the bug where oauth_bearer gets deallocated when we re-use a
 connection.
 Closes #4824
 Upstream-commit: dea17b519dc1d83265ca6aa9a484a2cf242db3b9
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/curl_sasl.c | 14 ++++++++------
 lib/http.c      | 12 +++++-------
 lib/url.c       |  9 ---------
 lib/urldata.h   |  2 --
 4 files changed, 13 insertions(+), 24 deletions(-)
 diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c
 index 354bc54..c767bef 100644
 --- a/lib/curl_sasl.c
 +++ b/lib/curl_sasl.c
@@ -269,6 +269,7 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn,
     data->set.str[STRING_SERVICE_NAME] :
     sasl->params->service;
 #endif
 +  const char *oauth_bearer = data->set.str[STRING_BEARER];
   sasl->force_ir = force_ir;    /* Latch for future use */
   sasl->authused = 0;           /* No mechanism used yet */
@@ -339,7 +340,7 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn,
       }
     else
 #endif
 -    if((enabledmechs & SASL_MECH_OAUTHBEARER) && conn->oauth_bearer) {
 +    if((enabledmechs & SASL_MECH_OAUTHBEARER) && oauth_bearer) {
       mech = SASL_MECH_STRING_OAUTHBEARER;
       state1 = SASL_OAUTH2;
       state2 = SASL_OAUTH2_RESP;
@@ -349,10 +350,10 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn,
         result = Curl_auth_create_oauth_bearer_message(data, conn->user,
                                                        hostname,
                                                        port,
 -                                                       conn->oauth_bearer,
 +                                                       oauth_bearer,
                                                        &resp, &len);
     }
 -    else if((enabledmechs & SASL_MECH_XOAUTH2) && conn->oauth_bearer) {
 +    else if((enabledmechs & SASL_MECH_XOAUTH2) && oauth_bearer) {
       mech = SASL_MECH_STRING_XOAUTH2;
       state1 = SASL_OAUTH2;
       sasl->authused = SASL_MECH_XOAUTH2;
@@ -360,7 +361,7 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn,
       if(force_ir || data->set.sasl_ir)
         result = Curl_auth_create_oauth_bearer_message(data, conn->user,
                                                        NULL, 0,
 -                                                       conn->oauth_bearer,
 +                                                       oauth_bearer,
                                                        &resp, &len);
     }
     else if(enabledmechs & SASL_MECH_PLAIN) {
@@ -429,6 +430,7 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct connectdata *conn,
   char *serverdata;
 #endif
   size_t len = 0;
 +  const char *oauth_bearer = data->set.str[STRING_BEARER];
   *progress = SASL_INPROGRESS;
@@ -556,7 +558,7 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct connectdata *conn,
       result = Curl_auth_create_oauth_bearer_message(data, conn->user,
                                                      hostname,
                                                      port,
 -                                                     conn->oauth_bearer,
 +                                                     oauth_bearer,
                                                      &resp, &len);
       /* Failures maybe sent by the server as continuations for OAUTHBEARER */
@@ -565,7 +567,7 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct connectdata *conn,
     else
       result = Curl_auth_create_oauth_bearer_message(data, conn->user,
                                                      NULL, 0,
 -                                                     conn->oauth_bearer,
 +                                                     oauth_bearer,
                                                      &resp, &len);
     break;
 diff --git a/lib/http.c b/lib/http.c
 index 26eb52d..bf19077 100644
 --- a/lib/http.c
 +++ b/lib/http.c
@@ -326,7 +326,7 @@ static CURLcode http_output_bearer(struct connectdata *conn)
   userp = &conn->allocptr.userpwd;
   free(*userp);
   *userp = aprintf("Authorization: Bearer %s\r\n",
 -                   conn->oauth_bearer);
 +                   conn->data->set.str[STRING_BEARER]);
   if(!*userp) {
     result = CURLE_OUT_OF_MEMORY;
@@ -510,7 +510,7 @@ CURLcode Curl_http_auth_act(struct connectdata *conn)
   CURLcode result = CURLE_OK;
   unsigned long authmask = ~0ul;
 -  if(!conn->oauth_bearer)
 +  if(!data->set.str[STRING_BEARER])
     authmask &= (unsigned long)~CURLAUTH_BEARER;
   if(100 <= data->req.httpcode && 199 >= data->req.httpcode)
@@ -520,7 +520,7 @@ CURLcode Curl_http_auth_act(struct connectdata *conn)
   if(data->state.authproblem)
     return data->set.http_fail_on_error?CURLE_HTTP_RETURNED_ERROR:CURLE_OK;
 -  if((conn->bits.user_passwd || conn->oauth_bearer) &&
 +  if((conn->bits.user_passwd || data->set.str[STRING_BEARER]) &&
      ((data->req.httpcode == 401) ||
       (conn->bits.authneg && data->req.httpcode < 300))) {
     pickhost = pickoneauth(&data->state.authhost, authmask);
@@ -590,9 +590,7 @@ output_auth_headers(struct connectdata *conn,
 {
   const char *auth = NULL;
   CURLcode result = CURLE_OK;
 -#if !defined(CURL_DISABLE_VERBOSE_STRINGS) || defined(USE_SPNEGO)
   struct Curl_easy *data = conn->data;
 -#endif
 #ifdef USE_SPNEGO
   struct negotiatedata *negdata = proxy ?
     &data->state.proxyneg : &data->state.negotiate;
@@ -664,7 +662,7 @@ output_auth_headers(struct connectdata *conn,
   }
   if(authstatus->picked == CURLAUTH_BEARER) {
     /* Bearer */
 -    if((!proxy && conn->oauth_bearer &&
 +    if((!proxy && data->set.str[STRING_BEARER] &&
         !Curl_checkheaders(conn, "Authorization:"))) {
       auth = "Bearer";
       result = http_output_bearer(conn);
@@ -722,7 +720,7 @@ Curl_http_output_auth(struct connectdata *conn,
   authproxy = &data->state.authproxy;
   if((conn->bits.httpproxy && conn->bits.proxy_user_passwd) ||
 -     conn->bits.user_passwd || conn->oauth_bearer)
 +     conn->bits.user_passwd || data->set.str[STRING_BEARER])
     /* continue please */;
   else {
     authhost->done = TRUE;
 diff --git a/lib/url.c b/lib/url.c
 index 4803653..fca0855 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -686,7 +686,6 @@ static void conn_free(struct connectdata *conn)
   Curl_safefree(conn->user);
   Curl_safefree(conn->passwd);
 -  Curl_safefree(conn->oauth_bearer);
   Curl_safefree(conn->options);
   Curl_safefree(conn->http_proxy.user);
   Curl_safefree(conn->socks_proxy.user);
@@ -4161,14 +4160,6 @@ static CURLcode create_conn(struct Curl_easy *data,
     }
   }
 -  if(data->set.str[STRING_BEARER]) {
 -    conn->oauth_bearer = strdup(data->set.str[STRING_BEARER]);
 -    if(!conn->oauth_bearer) {
 -      result = CURLE_OUT_OF_MEMORY;
 -      goto out;
 -    }
 -  }
 -
 #ifdef USE_UNIX_SOCKETS
   if(data->set.str[STRING_UNIX_SOCKET_PATH]) {
     conn->unix_domain_socket = strdup(data->set.str[STRING_UNIX_SOCKET_PATH]);
 diff --git a/lib/urldata.h b/lib/urldata.h
 index 72a36fb..73a185c 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -850,8 +850,6 @@ struct connectdata {
   char *passwd;  /* password string, allocated */
   char *options; /* options string, allocated */
 -  char *oauth_bearer; /* bearer token for OAuth 2.0, allocated */
 -
   int httpversion;        /* the HTTP version*10 reported by the server */
   int rtspversion;        /* the RTSP version*10 reported by the server */
 -- 
 2.34.1
 From 85d1103c2fc0c9b1bdfae470dbafd45758e1c2f0 Mon Sep 17 00:00:00 2001
 From: Patrick Monnerat <patrick@monnerat.net>
 Date: Mon, 25 Apr 2022 11:44:05 +0200
 Subject: [PATCH 2/2] url: check sasl additional parameters for connection
 reuse.
 Also move static function safecmp() as non-static Curl_safecmp() since
 its purpose is needed at several places.
 Bug: https://curl.se/docs/CVE-2022-22576.html
 CVE-2022-22576
 Closes #8746
 Upstream-commit: 852aa5ad351ea53e5f01d2f44b5b4370c2bf5425
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/strcase.c   | 10 ++++++++++
 lib/strcase.h   |  2 ++
 lib/url.c       | 12 +++++++++++-
 lib/urldata.h   |  2 ++
 lib/vtls/vtls.c | 19 +++++--------------
 5 files changed, 30 insertions(+), 15 deletions(-)
 diff --git a/lib/strcase.c b/lib/strcase.c
 index dd46ca1..692a3f1 100644
 --- a/lib/strcase.c
 +++ b/lib/strcase.c
@@ -165,6 +165,16 @@ void Curl_strntoupper(char *dest, const char *src, size_t n)
   } while(*src++ && --n);
 }
 +/* Compare case-sensitive NUL-terminated strings, taking care of possible
 + * null pointers. Return true if arguments match.
 + */
 +bool Curl_safecmp(char *a, char *b)
 +{
 +  if(a && b)
 +    return !strcmp(a, b);
 +  return !a && !b;
 +}
 +
 /* --- public functions --- */
 int curl_strequal(const char *first, const char *second)
 diff --git a/lib/strcase.h b/lib/strcase.h
 index b628656..382b80a 100644
 --- a/lib/strcase.h
 +++ b/lib/strcase.h
@@ -47,4 +47,6 @@ char Curl_raw_toupper(char in);
 void Curl_strntoupper(char *dest, const char *src, size_t n);
 +bool Curl_safecmp(char *a, char *b);
 +
 #endif /* HEADER_CURL_STRCASE_H */
 diff --git a/lib/url.c b/lib/url.c
 index adef2cd..94e3406 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -701,6 +701,7 @@ static void conn_free(struct connectdata *conn)
   Curl_safefree(conn->allocptr.host);
   Curl_safefree(conn->allocptr.cookiehost);
   Curl_safefree(conn->allocptr.rtsp_transport);
 +  Curl_safefree(conn->oauth_bearer);
   Curl_safefree(conn->trailer);
   Curl_safefree(conn->host.rawalloc); /* host name buffer */
   Curl_safefree(conn->conn_to_host.rawalloc); /* host name buffer */
@@ -1291,7 +1292,8 @@ ConnectionExists(struct Curl_easy *data,
         /* This protocol requires credentials per connection,
            so verify that we're using the same name and password as well */
         if(strcmp(needle->user, check->user) ||
 -           strcmp(needle->passwd, check->passwd)) {
 +           strcmp(needle->passwd, check->passwd) ||
 +           !Curl_safecmp(needle->oauth_bearer, check->oauth_bearer)) {
           /* one of them was different */
           continue;
         }
@@ -4160,6 +4162,14 @@ static CURLcode create_conn(struct Curl_easy *data,
     }
   }
 +  if(data->set.str[STRING_BEARER]) {
 +    conn->oauth_bearer = strdup(data->set.str[STRING_BEARER]);
 +    if(!conn->oauth_bearer) {
 +      result = CURLE_OUT_OF_MEMORY;
 +      goto out;
 +    }
 +  }
 +
 #ifdef USE_UNIX_SOCKETS
   if(data->set.str[STRING_UNIX_SOCKET_PATH]) {
     conn->unix_domain_socket = strdup(data->set.str[STRING_UNIX_SOCKET_PATH]);
 diff --git a/lib/urldata.h b/lib/urldata.h
 index cc8a600..03da59a 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -850,6 +850,8 @@ struct connectdata {
   char *passwd;  /* password string, allocated */
   char *options; /* options string, allocated */
 +  char *oauth_bearer; /* OAUTH2 bearer, allocated */
 +
   int httpversion;        /* the HTTP version*10 reported by the server */
   int rtspversion;        /* the RTSP version*10 reported by the server */
 diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
 index 03b85ba..a40ac06 100644
 --- a/lib/vtls/vtls.c
 +++ b/lib/vtls/vtls.c
@@ -82,15 +82,6 @@
   else                                       \
     dest->var = NULL;
 -static bool safecmp(char *a, char *b)
 -{
 -  if(a && b)
 -    return !strcmp(a, b);
 -  else if(!a && !b)
 -    return TRUE; /* match */
 -  return FALSE; /* no match */
 -}
 -
 bool
 Curl_ssl_config_matches(struct ssl_primary_config* data,
                         struct ssl_primary_config* needle)
@@ -100,11 +91,11 @@ Curl_ssl_config_matches(struct ssl_primary_config* data,
      (data->verifypeer == needle->verifypeer) &&
      (data->verifyhost == needle->verifyhost) &&
      (data->verifystatus == needle->verifystatus) &&
 -     safecmp(data->CApath, needle->CApath) &&
 -     safecmp(data->CAfile, needle->CAfile) &&
 -     safecmp(data->clientcert, needle->clientcert) &&
 -     safecmp(data->random_file, needle->random_file) &&
 -     safecmp(data->egdsocket, needle->egdsocket) &&
 +     Curl_safecmp(data->CApath, needle->CApath) &&
 +     Curl_safecmp(data->CAfile, needle->CAfile) &&
 +     Curl_safecmp(data->clientcert, needle->clientcert) &&
 +     Curl_safecmp(data->random_file, needle->random_file) &&
 +     Curl_safecmp(data->egdsocket, needle->egdsocket) &&
      Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) &&
      Curl_safe_strcasecompare(data->cipher_list13, needle->cipher_list13))
     return TRUE;
 -- 
 2.34.1
--- a/SOURCES/0037-curl-7.61.1-CVE-2022-27776.patch
+++ b/SOURCES/0037-curl-7.61.1-CVE-2022-27776.patch
@ -0,0 +1,710 @@
 From 24ff6b126726201cf778038c332b3b921c7f5b2f Mon Sep 17 00:00:00 2001
 From: Katsuhiko YOSHIDA <claddvd@gmail.com>
 Date: Sun, 30 Dec 2018 09:44:30 +0900
 Subject: [PATCH 1/6] cookies: skip custom cookies when redirecting cross-site
 Closes #3417
 Upstream-commit: 1f30dc886d1a4a6e81599a9f5f5e9f60d97801d4
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 docs/libcurl/opts/CURLOPT_HTTPHEADER.3 |  4 ++
 lib/http.c                             |  3 +-
 tests/data/Makefile.inc                |  2 +-
 tests/data/test330                     | 90 ++++++++++++++++++++++++++
 4 files changed, 97 insertions(+), 2 deletions(-)
 create mode 100644 tests/data/test330
 diff --git a/docs/libcurl/opts/CURLOPT_HTTPHEADER.3 b/docs/libcurl/opts/CURLOPT_HTTPHEADER.3
 index f5826e1..4af69f4 100644
 --- a/docs/libcurl/opts/CURLOPT_HTTPHEADER.3
 +++ b/docs/libcurl/opts/CURLOPT_HTTPHEADER.3
@@ -88,6 +88,10 @@ those servers will get all the contents of your custom headers too.
 Starting in 7.58.0, libcurl will specifically prevent "Authorization:" headers
 from being sent to other hosts than the first used one, unless specifically
 permitted with the \fICURLOPT_UNRESTRICTED_AUTH(3)\fP option.
 +
 +Starting in 7.64.0, libcurl will specifically prevent "Cookie:" headers
 +from being sent to other hosts than the first used one, unless specifically
 +permitted with the \fICURLOPT_UNRESTRICTED_AUTH(3)\fP option.
 .SH DEFAULT
 NULL
 .SH PROTOCOLS
 diff --git a/lib/http.c b/lib/http.c
 index bf19077..0b5e476 100644
 --- a/lib/http.c
 +++ b/lib/http.c
@@ -1774,7 +1774,8 @@ CURLcode Curl_add_custom_headers(struct connectdata *conn,
                   checkprefix("Transfer-Encoding:", headers->data))
             /* HTTP/2 doesn't support chunked requests */
             ;
 -          else if(checkprefix("Authorization:", headers->data) &&
 +          else if((checkprefix("Authorization:", headers->data) ||
 +                   checkprefix("Cookie:", headers->data)) &&
                   /* be careful of sending this potentially sensitive header to
                      other hosts */
                   (data->state.this_is_a_follow &&
 diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
 index e0f1ef4..77e85fd 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
@@ -56,7 +56,7 @@ test289 test290 test291 test292 test293 test294 test295 test296 test297 \
 test298 test299 test300 test301 test302 test303 test304 test305 test306 \
 test307 test308 test309 test310 test311 test312 test313 test314 test315 \
 test316 test317 test318 test319 test320 test321 test322 test323 test324 \
 -test325 test326 \
 +test325 test326 test330 \
 \
 test340 \
 \
 diff --git a/tests/data/test330 b/tests/data/test330
 new file mode 100644
 index 0000000..74607d5
 --- /dev/null
 +++ b/tests/data/test330
@@ -0,0 +1,90 @@
 +<testcase>
 +<info>
 +<keywords>
 +HTTP
 +followlocation
 +cookies
 +</keywords>
 +</info>
 +#
 +# Server-side
 +<reply>
 +<data>
 +HTTP/1.1 302 OK
 +Date: Thu, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake swsclose
 +Content-Type: text/html
 +Funny-head: yesyes
 +Location: http://goto.second.host.now/3170002
 +Content-Length: 8
 +Connection: close
 +
 +contents
 +</data>
 +<data2>
 +HTTP/1.1 200 OK
 +Date: Thu, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake swsclose
 +Content-Type: text/html
 +Funny-head: yesyes
 +Content-Length: 9
 +
 +contents
 +</data2>
 +
 +<datacheck>
 +HTTP/1.1 302 OK
 +Date: Thu, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake swsclose
 +Content-Type: text/html
 +Funny-head: yesyes
 +Location: http://goto.second.host.now/3170002
 +Content-Length: 8
 +Connection: close
 +
 +HTTP/1.1 200 OK
 +Date: Thu, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake swsclose
 +Content-Type: text/html
 +Funny-head: yesyes
 +Content-Length: 9
 +
 +contents
 +</datacheck>
 +</reply>
 +
 +#
 +# Client-side
 +<client>
 +<server>
 +http
 +</server>
 + <name>
 +HTTP with custom Cookie: and redirect to new host
 + </name>
 + <command>
 +http://first.host.it.is/we/want/that/page/317 -x %HOSTIP:%HTTPPORT -H "Cookie: test=yes" --location
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<strip>
 +^User-Agent:.*
 +</strip>
 +<protocol>
 +GET http://first.host.it.is/we/want/that/page/317 HTTP/1.1
 +Host: first.host.it.is
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +Cookie: test=yes
 +
 +GET http://goto.second.host.now/3170002 HTTP/1.1
 +Host: goto.second.host.now
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +
 +</protocol>
 +</verify>
 +</testcase>
 -- 
 2.34.1
 From a3f3855c8bf3a39ef0d86ef04087c200bca765f1 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 19 Dec 2019 16:45:53 +0100
 Subject: [PATCH 2/6] sws: search for "Testno:" header uncondtionally if no
 testno
 Even if the initial request line wasn't found. With the fix to 1455, the
 test number is now detected correctly.
 (Problem found when running tests in random order.)
 Closes #4744
 Upstream-commit: 25b69c482f45c7acd817920bd8fdf68887be51a2
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/data/test1455 |  3 ++-
 tests/server/sws.c  | 40 +++++++++++++++++++++++-----------------
 2 files changed, 25 insertions(+), 18 deletions(-)
 diff --git a/tests/data/test1455 b/tests/data/test1455
 index 0b77dc4..25f742e 100644
 --- a/tests/data/test1455
 +++ b/tests/data/test1455
@@ -35,7 +35,7 @@ http
 HTTP GET when PROXY Protocol enabled
 </name>
 <command>
 -http://%HOSTIP:%HTTPPORT/1455 --haproxy-protocol
 +http://%HOSTIP:%HTTPPORT/1455 --haproxy-protocol -H "Testno: 1455"
 </command>
 </client>
@@ -53,6 +53,7 @@ proxy-line
 GET /1455 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
 +Testno: 1455
 </protocol>
 </verify>
 diff --git a/tests/server/sws.c b/tests/server/sws.c
 index fbe7761..4ece830 100644
 --- a/tests/server/sws.c
 +++ b/tests/server/sws.c
@@ -367,6 +367,8 @@ static int parse_servercmd(struct httprequest *req)
   filename = test2file(req->testno);
   req->close = FALSE;
 +  req->connmon = FALSE;
 +
   stream = fopen(filename, "rb");
   if(!stream) {
     error = errno;
@@ -391,8 +393,6 @@ static int parse_servercmd(struct httprequest *req)
       return 1; /* done */
     }
 -    req->connmon = FALSE;
 -
     cmd = orgcmd;
     while(cmd && cmdsize) {
       char *check;
@@ -548,12 +548,11 @@ static int ProcessRequest(struct httprequest *req)
         snprintf(logbuf, sizeof(logbuf), "Requested test number %ld part %ld",
                  req->testno, req->partno);
         logmsg("%s", logbuf);
 -
 -        /* find and parse <servercmd> for this test */
 -        parse_servercmd(req);
       }
 -      else
 +      else {
 +        logmsg("No test number");
         req->testno = DOCNUMBER_NOTHING;
 +      }
     }
@@ -613,14 +612,6 @@ static int ProcessRequest(struct httprequest *req)
       }
     }
 -    if(req->testno == DOCNUMBER_NOTHING) {
 -      /* check for a Testno: header with the test case number */
 -      char *testno = strstr(line, "\nTestno: ");
 -      if(testno) {
 -        req->testno = strtol(&testno[9], NULL, 10);
 -        logmsg("Found test number %d in Testno: header!", req->testno);
 -      }
 -    }
     if(req->testno == DOCNUMBER_NOTHING) {
       /* Still no test case number. Try to get the the number off the last dot
          instead, IE we consider the TLD to be the test number. Test 123 can
@@ -661,8 +652,8 @@ static int ProcessRequest(struct httprequest *req)
     }
   }
   else if((req->offset >= 3) && (req->testno == DOCNUMBER_NOTHING)) {
 -    logmsg("** Unusual request. Starts with %02x %02x %02x",
 -           line[0], line[1], line[2]);
 +    logmsg("** Unusual request. Starts with %02x %02x %02x (%c%c%c)",
 +           line[0], line[1], line[2], line[0], line[1], line[2]);
   }
   if(!end) {
@@ -670,7 +661,22 @@ static int ProcessRequest(struct httprequest *req)
     logmsg("request not complete yet");
     return 0; /* not complete yet */
   }
 -  logmsg("- request found to be complete");
 +  logmsg("- request found to be complete (%d)", req->testno);
 +
 +  if(req->testno == DOCNUMBER_NOTHING) {
 +    /* check for a Testno: header with the test case number */
 +    char *testno = strstr(line, "\nTestno: ");
 +    if(testno) {
 +      req->testno = strtol(&testno[9], NULL, 10);
 +      logmsg("Found test number %d in Testno: header!", req->testno);
 +    }
 +    else {
 +      logmsg("No Testno: header");
 +    }
 +  }
 +
 +  /* find and parse <servercmd> for this test */
 +  parse_servercmd(req);
   if(use_gopher) {
     /* when using gopher we cannot check the request until the entire
 -- 
 2.34.1
 From 3772ea764c05a1cf37b96c091ae266138e8a2867 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 16 Apr 2020 14:16:22 +0200
 Subject: [PATCH 3/6] runtests: always put test number in servercmd file
 Upstream-commit: d1a2816b4128faa8ebc50ce93285c7364652856e
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/runtests.pl | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)
 diff --git a/tests/runtests.pl b/tests/runtests.pl
 index a0fd991..8d8ed81 100755
 --- a/tests/runtests.pl
 +++ b/tests/runtests.pl
@@ -3878,10 +3878,9 @@ sub singletest {
     unlink($SERVER2IN);
     unlink($PROXYIN);
 -    if(@ftpservercmd) {
 -        # write the instructions to file
 -        writearray($FTPDCMD, \@ftpservercmd);
 -    }
 +    push @ftpservercmd, "Testnum $testnum\n";
 +    # write the instructions to file
 +    writearray($FTPDCMD, \@ftpservercmd);
     # get the command line options to use
     my @blaha;
@@ -4222,9 +4221,6 @@ sub singletest {
         }
     }
 -    # remove the test server commands file after each test
 -    unlink($FTPDCMD) if(-f $FTPDCMD);
 -
     # run the postcheck command
     my @postcheck= getpart("client", "postcheck");
     if(@postcheck) {
 -- 
 2.34.1
 From ac04f6feaa19c636aa09a1b50643d70a77be4465 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 14 May 2020 17:45:40 +0200
 Subject: [PATCH 4/6] sws: as last resort, get test number from server cmd file
 If it can't be found in the request. Also support --cmdfile to set it to
 a custom file name.
 runtests.pl always writes this file with the test number in it since a
 while back.
 Upstream-commit: a3b0699d5c110270f09ac51b5b465ca8753b35a9
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/server/sws.c | 68 ++++++++++++++++++++++++++++++++++------------
 1 file changed, 51 insertions(+), 17 deletions(-)
 diff --git a/tests/server/sws.c b/tests/server/sws.c
 index 4ece830..2696872 100644
 --- a/tests/server/sws.c
 +++ b/tests/server/sws.c
@@ -155,6 +155,10 @@ const char *serverlogfile = DEFAULT_LOGFILE;
 #define REQUEST_PROXY_DUMP  "log/proxy.input"
 #define RESPONSE_PROXY_DUMP "log/proxy.response"
 +/* file in which additional instructions may be found */
 +#define DEFAULT_CMDFILE "log/ftpserver.cmd"
 +const char *cmdfile = DEFAULT_CMDFILE;
 +
 /* very-big-path support */
 #define MAXDOCNAMELEN 140000
 #define MAXDOCNAMELEN_TXT "139999"
@@ -358,6 +362,24 @@ static bool socket_domain_is_ip(void)
   }
 }
 +/* parse the file on disk that might have a test number for us */
 +static int parse_cmdfile(struct httprequest *req)
 +{
 +  int testnum = DOCNUMBER_NOTHING;
 +  char buf[256];
 +  FILE *f = fopen(cmdfile, FOPEN_READTEXT);
 +  if(f) {
 +    while(fgets(buf, sizeof(buf), f)) {
 +      if(1 == sscanf(buf, "Testnum %d", &testnum)) {
 +        logmsg("[%s] cmdfile says testnum %d", cmdfile, testnum);
 +        req->testno = testnum;
 +      }
 +    }
 +    fclose(f);
 +  }
 +  return 0;
 +}
 +
 /* based on the testno, parse the correct server commands */
 static int parse_servercmd(struct httprequest *req)
 {
@@ -622,34 +644,41 @@ static int ProcessRequest(struct httprequest *req)
       /* get the number after it */
       if(ptr) {
 +        long num;
         ptr++; /* skip the dot */
 -        req->testno = strtol(ptr, &ptr, 10);
 +        num = strtol(ptr, &ptr, 10);
 -        if(req->testno > 10000) {
 -          req->partno = req->testno % 10000;
 -          req->testno /= 10000;
 +        if(num) {
 +          req->testno = num;
 +          if(req->testno > 10000) {
 +            req->partno = req->testno % 10000;
 +            req->testno /= 10000;
 -          logmsg("found test %d in requested host name", req->testno);
 +            logmsg("found test %d in requested host name", req->testno);
 +          }
 +          else
 +            req->partno = 0;
         }
 -        else
 -          req->partno = 0;
 -        snprintf(logbuf, sizeof(logbuf),
 -                 "Requested test number %ld part %ld (from host name)",
 +        if(req->testno != DOCNUMBER_NOTHING) {
 +          logmsg("Requested test number %ld part %ld (from host name)",
                  req->testno, req->partno);
 -        logmsg("%s", logbuf);
 -
 +        }
       }
 +    }
 -      if(!req->testno) {
 -        logmsg("Did not find test number in PATH");
 -        req->testno = DOCNUMBER_404;
 -      }
 -      else
 -        parse_servercmd(req);
 +    if(req->testno == DOCNUMBER_NOTHING)
 +      /* might get the test number */
 +      parse_cmdfile(req);
 +
 +    if(req->testno == DOCNUMBER_NOTHING) {
 +      logmsg("Did not find test number in PATH");
 +      req->testno = DOCNUMBER_404;
     }
 +    else
 +      parse_servercmd(req);
   }
   else if((req->offset >= 3) && (req->testno == DOCNUMBER_NOTHING)) {
     logmsg("** Unusual request. Starts with %02x %02x %02x (%c%c%c)",
@@ -2038,6 +2067,11 @@ int main(int argc, char *argv[])
       if(argc>arg)
         serverlogfile = argv[arg++];
     }
 +    else if(!strcmp("--cmdfile", argv[arg])) {
 +      arg++;
 +      if(argc>arg)
 +        cmdfile = argv[arg++];
 +    }
     else if(!strcmp("--gopher", argv[arg])) {
       arg++;
       use_gopher = TRUE;
 -- 
 2.34.1
 From 9fa56a1e3ae7feff14668d8abd892fa028a9f32e Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 25 Apr 2022 13:05:40 +0200
 Subject: [PATCH 5/6] http: avoid auth/cookie on redirects same host diff port
 CVE-2022-27776
 Reported-by: Harry Sintonen
 Bug: https://curl.se/docs/CVE-2022-27776.html
 Closes #8749
 Upstream-commit: 6e659993952aa5f90f48864be84a1bbb047fc258
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/http.c    | 33 +++++++++++++++++++++------------
 lib/urldata.h | 16 +++++++++-------
 2 files changed, 30 insertions(+), 19 deletions(-)
 diff --git a/lib/http.c b/lib/http.c
 index 0b5e476..39fc7aa 100644
 --- a/lib/http.c
 +++ b/lib/http.c
@@ -688,6 +688,21 @@ output_auth_headers(struct connectdata *conn,
   return CURLE_OK;
 }
 +/*
 + * allow_auth_to_host() tells if autentication, cookies or other "sensitive
 + * data" can (still) be sent to this host.
 + */
 +static bool allow_auth_to_host(struct connectdata *conn)
 +{
 +  struct Curl_easy *data = conn->data;
 +  return (!data->state.this_is_a_follow ||
 +          data->set.allow_auth_to_other_hosts ||
 +          (data->state.first_host &&
 +           strcasecompare(data->state.first_host, conn->host.name) &&
 +           (data->state.first_remote_port == conn->remote_port) &&
 +           (data->state.first_remote_protocol == conn->handler->protocol)));
 +}
 +
 /**
  * Curl_http_output_auth() setups the authentication headers for the
  * host/proxy and the correct authentication
@@ -756,15 +771,11 @@ Curl_http_output_auth(struct connectdata *conn,
        with it */
     authproxy->done = TRUE;
 -  /* To prevent the user+password to get sent to other than the original
 -     host due to a location-follow, we do some weirdo checks here */
 -  if(!data->state.this_is_a_follow ||
 -     conn->bits.netrc ||
 -     !data->state.first_host ||
 -     data->set.allow_auth_to_other_hosts ||
 -     strcasecompare(data->state.first_host, conn->host.name)) {
 +  /* To prevent the user+password to get sent to other than the original host
 +     due to a location-follow */
 +  if(allow_auth_to_host(conn)
 +     || conn->bits.netrc)
     result = output_auth_headers(conn, authhost, request, path, FALSE);
 -  }
   else
     authhost->done = TRUE;
@@ -1778,10 +1789,7 @@ CURLcode Curl_add_custom_headers(struct connectdata *conn,
                    checkprefix("Cookie:", headers->data)) &&
                   /* be careful of sending this potentially sensitive header to
                      other hosts */
 -                  (data->state.this_is_a_follow &&
 -                   data->state.first_host &&
 -                   !data->set.allow_auth_to_other_hosts &&
 -                   !strcasecompare(data->state.first_host, conn->host.name)))
 +                  !allow_auth_to_host(conn))
             ;
           else {
             result = Curl_add_bufferf(req_buffer, "%s\r\n", headers->data);
@@ -1937,6 +1945,7 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
       return CURLE_OUT_OF_MEMORY;
     data->state.first_remote_port = conn->remote_port;
 +    data->state.first_remote_protocol = conn->handler->protocol;
   }
   http->writebytecount = http->readbytecount = 0;
 diff --git a/lib/urldata.h b/lib/urldata.h
 index d3b971c..4bb0a84 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -1231,13 +1231,15 @@ struct UrlState {
                                 bytes / second */
   bool this_is_a_follow; /* this is a followed Location: request */
   bool refused_stream; /* this was refused, try again */
 -  char *first_host; /* host name of the first (not followed) request.
 -                       if set, this should be the host name that we will
 -                       sent authorization to, no else. Used to make Location:
 -                       following not keep sending user+password... This is
 -                       strdup() data.
 -                    */
 -  int first_remote_port; /* remote port of the first (not followed) request */
 +
 +  /* host name, port number and protocol of the first (not followed) request.
 +     if set, this should be the host name that we will sent authorization to,
 +     no else. Used to make Location: following not keep sending user+password.
 +     This is strdup()ed data. */
 +  char *first_host;
 +  int first_remote_port;
 +  unsigned int first_remote_protocol;
 +
   struct curl_ssl_session *session; /* array of 'max_ssl_sessions' size */
   long sessionage;                  /* number of the most recent session */
   unsigned int tempcount; /* number of entries in use in tempwrite, 0 - 3 */
 -- 
 2.34.1
 From a8bb1e37e22788abaca37c59cf447d690fdcdfa4 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 25 Apr 2022 13:05:47 +0200
 Subject: [PATCH 6/6] test898: verify the fix for CVE-2022-27776
 Do not pass on Authorization headers on redirects to another port
 Upstream-commit: afe752e0504ab60bf63787ede0b992cbe1065f78
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/data/Makefile.inc |  2 +-
 tests/data/test898      | 91 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 92 insertions(+), 1 deletion(-)
 create mode 100644 tests/data/test898
 diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
 index 77e85fd..58c9e31 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
@@ -99,7 +99,7 @@ test850 test851 test852 test853 test854 test855 test856 test857 test858 \
 test859 test860 test861 test862 test863 test864 test865 test866 test867 \
 test868 test869 test870 test871 test872 test873 test874 test875 test876 \
 test877 test878 test879 test880 test881 test882 test883 test884 test885 \
 -test886 test887 test888 test889 test890 test891 \
 +test886 test887 test888 test889 test890 test891 test898 \
 \
 test900 test901 test902 test903 test904 test905 test906 test907 test908 \
 test909 test910 test911 test912 test913 test914 test915 test916 test917 \
 diff --git a/tests/data/test898 b/tests/data/test898
 new file mode 100644
 index 0000000..e295c26
 --- /dev/null
 +++ b/tests/data/test898
@@ -0,0 +1,91 @@
 +<testcase>
 +<info>
 +<keywords>
 +HTTP
 +--location
 +Authorization
 +Cookie
 +</keywords>
 +</info>
 +
 +#
 +# Server-side
 +<reply>
 +<data>
 +HTTP/1.1 301 redirect
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
 +Location: http://firsthost.com:9999/a/path/8980002
 +
 +</data>
 +<data2>
 +HTTP/1.1 200 OK
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 4
 +Connection: close
 +Content-Type: text/html
 +
 +hey
 +</data2>
 +
 +<datacheck>
 +HTTP/1.1 301 redirect
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
 +Location: http://firsthost.com:9999/a/path/8980002
 +
 +HTTP/1.1 200 OK
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 4
 +Connection: close
 +Content-Type: text/html
 +
 +hey
 +</datacheck>
 +
 +</reply>
 +
 +#
 +# Client-side
 +<client>
 +<server>
 +http
 +</server>
 + <name>
 +HTTP with custom auth and cookies redirected to HTTP on a diff port
 + </name>
 + <command>
 +-x http://%HOSTIP:%HTTPPORT http://firsthost.com -L -H "Authorization: Basic am9lOnNlY3JldA==" -H "Cookie: userpwd=am9lOnNlY3JldA=="
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<strip>
 +^User-Agent:.*
 +</strip>
 +<protocol>
 +GET http://firsthost.com/ HTTP/1.1
 +Host: firsthost.com
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +Authorization: Basic am9lOnNlY3JldA==
 +Cookie: userpwd=am9lOnNlY3JldA==
 +
 +GET http://firsthost.com:9999/a/path/8980002 HTTP/1.1
 +Host: firsthost.com:9999
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +
 +</protocol>
 +</verify>
 +</testcase>
 -- 
 2.34.1
--- a/SOURCES/0038-curl-7.61.1-CVE-2022-27774.patch
+++ b/SOURCES/0038-curl-7.61.1-CVE-2022-27774.patch
@ -1,4 +1,4 @@
-From ecee0926868d138312e9608531b232f697e50cad Mon Sep 17 00:00:00 2001
+From 48f126157d36962e458bf12f90b50cfcef26eee9 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 25 Apr 2022 16:24:33 +0200
 Subject: [PATCH 1/4] connect: store "conn_remote_port" in the info struct
@ -13,39 +13,39 @@ Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 2 files changed, 6 insertions(+), 1 deletion(-)
 diff --git a/lib/connect.c b/lib/connect.c
-index 64f9511..7518807 100644
+index f724646..12a8aae 100644
 --- a/lib/connect.c
 +++ b/lib/connect.c
-@@ -619,6 +619,7 @@ void Curl_persistconninfo(struct Curl_easy *data, struct connectdata *conn,
+@@ -614,6 +614,7 @@ void Curl_persistconninfo(struct connectdata *conn)
-   data->info.conn_scheme = conn->handler->scheme;
+   conn->data->info.conn_scheme = conn->handler->scheme;
-   data->info.conn_protocol = conn->handler->protocol;
+   conn->data->info.conn_protocol = conn->handler->protocol;
-   data->info.conn_primary_port = conn->port;
+   conn->data->info.conn_primary_port = conn->primary_port;
-+  data->info.conn_remote_port = conn->remote_port;
+  conn->data->info.conn_remote_port = conn->remote_port;
-   data->info.conn_local_port = local_port;
+   conn->data->info.conn_local_port = conn->local_port;
 }
 diff --git a/lib/urldata.h b/lib/urldata.h
-index f92052a..5218f76 100644
+index 4bb0a84..cadf0e5 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
-@@ -1167,7 +1167,11 @@ struct PureInfo {
+@@ -1050,7 +1050,11 @@ struct PureInfo {
      reused, in the connection cache. */
   char conn_primary_ip[MAX_IPADR_LEN];
-  int conn_primary_port;
+-  long conn_primary_port;
-+  int conn_primary_port; /* this is the destination port to the connection,
+  long conn_primary_port;/* this is the destination port to the connection,
 +                            which might have been a proxy */
 +  int conn_remote_port;  /* this is the "remote port", which is the port
 +                            number of the used URL, independent of proxy or
 +                            not */
   char conn_local_ip[MAX_IPADR_LEN];
-   int conn_local_port;
+   long conn_local_port;
   const char *conn_scheme;
 -- 
 2.34.1
-From 12c129f8d0b165d83ed954f68717d88ffc1cfc5f Mon Sep 17 00:00:00 2001
+From 6307fa6f9784402ba58697f46ba04354225391b7 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 25 Apr 2022 16:24:33 +0200
 Subject: [PATCH 2/4] transfer: redirects to other protocols or ports clear
@ -60,77 +60,149 @@ Closes #8748
 Upstream-commit: 620ea21410030a9977396b4661806bc187231b79
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
- lib/transfer.c | 49 ++++++++++++++++++++++++++++++++++++++++++++++++-
+ lib/transfer.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 48 insertions(+), 1 deletion(-)
+ lib/url.c      | 27 ++++++++++++++--------
 lib/urldata.h  |  1 +
 3 files changed, 81 insertions(+), 10 deletions(-)
 diff --git a/lib/transfer.c b/lib/transfer.c
-index 1f8019b..752fe14 100644
+index ad5a7ba..2022cba 100644
 --- a/lib/transfer.c
 +++ b/lib/transfer.c
-@@ -1641,10 +1641,57 @@ CURLcode Curl_follow(struct Curl_easy *data,
+@@ -1370,6 +1370,7 @@ CURLcode Curl_pretransfer(struct Curl_easy *data)
-       return CURLE_OUT_OF_MEMORY;
+   data->state.wildcardmatch = data->set.wildcard_enabled;
   data->set.followlocation = 0; /* reset the location-follow counter */
   data->state.this_is_a_follow = FALSE; /* reset this */
 +  data->state.this_is_a_follow_without_auth = FALSE;
   data->state.errorbuf = FALSE; /* no error has occurred */
   data->state.httpversion = 0; /* don't assume any particular server version */
@@ -1554,6 +1555,68 @@ CURLcode Curl_follow(struct Curl_easy *data,
   }
-   else {
+ 
 -
     uc = curl_url_get(data->state.uh, CURLUPART_URL, &newurl, 0);
     if(uc)
       return Curl_uc_to_curlcode(uc);
 +
 +  /* Clear auth if this redirects to a different port number or protocol,
 +     unless permitted */
 +  if(!data->set.allow_auth_to_other_hosts && (type != FOLLOW_FAKE)) {
 +      char *portnum;
 +    int port;
 +    bool clear = FALSE;
 +
 +    CURLU *u = curl_url();
 +    if(!u)
 +      return CURLE_OUT_OF_MEMORY;
 +
 +    uc = curl_url_set(u, CURLUPART_URL, newurl,
 +        ((type == FOLLOW_REDIR) ? CURLU_URLENCODE : 0));
 +    if(uc) {
 +      infof(data, "Clear auth, curl_url_set() failed\n");
 +      clear = TRUE;
 +    }
 +
 +    if(!clear) {
 +      if(data->set.use_port && data->state.allow_port)
 +        /* a custom port is used */
 +        port = (int)data->set.use_port;
 +      else {
-+        uc = curl_url_get(data->state.uh, CURLUPART_PORT, &portnum,
+        char *portnum;
-+                          CURLU_DEFAULT_PORT);
+        uc = curl_url_get(u, CURLUPART_PORT, &portnum, CURLU_DEFAULT_PORT);
 +        if(uc) {
-+          free(newurl);
+          infof(data, "Clear auth, failed to parse port number\n");
 +          return Curl_uc_to_curlcode(uc);
 +        }
 +        port = atoi(portnum);
 +        free(portnum);
 +      }
 +      if(port != data->info.conn_remote_port) {
 +        infof(data, "Clear auth, redirects to port from %u to %u",
 +              data->info.conn_remote_port, port);
 +          clear = TRUE;
 +        }
 +        else {
 +          port = atoi(portnum);
 +          free(portnum);
 +        }
 +      }
 +    }
 +    if(!clear && port != data->info.conn_remote_port) {
 +      infof(data, "Clear auth, redirects to port from %u to %u\n",
 +            data->info.conn_remote_port, port);
 +      clear = TRUE;
 +    }
 +    if(!clear) {
 +      char *scheme;
 +      const struct Curl_handler *p;
-+        uc = curl_url_get(data->state.uh, CURLUPART_SCHEME, &scheme, 0);
+      uc = curl_url_get(u, CURLUPART_SCHEME, &scheme, 0);
 +      if(uc) {
-+          free(newurl);
+        infof(data, "Clear auth, failed to parse scheme\n");
-+          return Curl_uc_to_curlcode(uc);
+        clear = TRUE;
 +      }
-+
+      else {
 +        p = Curl_builtin_scheme(scheme);
 +        if(p && (p->protocol != data->info.conn_protocol)) {
-+          infof(data, "Clear auth, redirects scheme from %s to %s",
+          infof(data, "Clear auth, redirects scheme from %s to %s\n",
 +                data->info.conn_scheme, scheme);
 +          clear = TRUE;
 +        }
 +        free(scheme);
 +      }
 +      if(clear) {
 +        Curl_safefree(data->state.aptr.user);
 +        Curl_safefree(data->state.aptr.passwd);
 +    }
 +    if(clear)
 +      data->state.this_is_a_follow_without_auth = TRUE;
 +    curl_url_cleanup(u);
 +  }
 +
   if(type == FOLLOW_FAKE) {
     /* we're only figuring out the new url if we would've followed locations
        but now we're done so we can get out! */
 diff --git a/lib/url.c b/lib/url.c
 index ed3c933..7dd5267 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -3483,18 +3483,25 @@ static CURLcode override_login(struct Curl_easy *data,
                                struct connectdata *conn,
                                char **userp, char **passwdp, char **optionsp)
 {
 -  if(data->set.str[STRING_USERNAME]) {
 -    free(*userp);
 -    *userp = strdup(data->set.str[STRING_USERNAME]);
 -    if(!*userp)
 -      return CURLE_OUT_OF_MEMORY;
 +  if(data->state.this_is_a_follow
 +      && data->state.this_is_a_follow_without_auth)
 +  {
 +    conn->bits.user_passwd = FALSE;
   }
 +  else {
 +    if(data->set.str[STRING_USERNAME]) {
 +      free(*userp);
 +      *userp = strdup(data->set.str[STRING_USERNAME]);
 +      if(!*userp)
 +        return CURLE_OUT_OF_MEMORY;
 +    }
 -  if(data->set.str[STRING_PASSWORD]) {
 -    free(*passwdp);
 -    *passwdp = strdup(data->set.str[STRING_PASSWORD]);
 -    if(!*passwdp)
 -      return CURLE_OUT_OF_MEMORY;
 +    if(data->set.str[STRING_PASSWORD]) {
 +      free(*passwdp);
 +      *passwdp = strdup(data->set.str[STRING_PASSWORD]);
 +      if(!*passwdp)
 +        return CURLE_OUT_OF_MEMORY;
 +    }
   }
-   if(type == FOLLOW_FAKE) {
+   if(data->set.str[STRING_OPTIONS]) {
 diff --git a/lib/urldata.h b/lib/urldata.h
 index cadf0e5..026684b 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -1234,6 +1234,7 @@ struct UrlState {
   curl_off_t current_speed;  /* the ProgressShow() function sets this,
                                 bytes / second */
   bool this_is_a_follow; /* this is a followed Location: request */
 +  bool this_is_a_follow_without_auth;
   bool refused_stream; /* this was refused, try again */
   /* host name, port number and protocol of the first (not followed) request.
 -- 
 2.34.1
-From 83bf4314d88cc16469afeaaefd6686a50371d1b7 Mon Sep 17 00:00:00 2001
+From b142f97840dfb033a1776d5a2986385da7753224 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 25 Apr 2022 16:24:33 +0200
 Subject: [PATCH 3/4] tests: verify the fix for CVE-2022-27774
@ -145,34 +217,34 @@ Upstream-commit: 5295e8d64ac6949ecb3f9e564317a608f51b90d8
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/data/Makefile.inc |  1 +
- tests/data/test973      | 88 +++++++++++++++++++++++++++++++++++++++++
+ tests/data/test973      | 90 +++++++++++++++++++++++++++++++++++++++++
- tests/data/test974      | 87 ++++++++++++++++++++++++++++++++++++++++
+ tests/data/test974      | 88 ++++++++++++++++++++++++++++++++++++++++
- tests/data/test975      | 88 +++++++++++++++++++++++++++++++++++++++++
+ tests/data/test975      | 90 +++++++++++++++++++++++++++++++++++++++++
- tests/data/test976      | 88 +++++++++++++++++++++++++++++++++++++++++
+ tests/data/test976      | 89 ++++++++++++++++++++++++++++++++++++++++
- 5 files changed, 352 insertions(+)
+ 5 files changed, 358 insertions(+)
 create mode 100644 tests/data/test973
 create mode 100644 tests/data/test974
 create mode 100644 tests/data/test975
 create mode 100644 tests/data/test976
 diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
-index 7ae2cf8..175fc43 100644
+index 58c9e31..6c920ff 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
-@@ -116,6 +116,7 @@ test936 test937 test938 test939 test940 test941 test942 test943 test944 \
+@@ -108,6 +108,7 @@ test927 test928 test929 test930 test931 test932 test933 test934 test935 \
- test945 test946 test947 test948 test949 test950 test951 test952 test953 \
+ test936 test937 test938 test939 test940 test941 test942 test943 test944 \
- test954 test955 test956 test957 test958 test959 test960 test961 test962 \
+ test945 test946 test947 test948 test949 test950 test951 test952 \
 test963 test964 test965 test966 test967 test968 test969 test970 test971 \
 +test973 test974 test975 test976 \
 \
 +test973 test974 test975 test976 \
 test980 test981 test982 test983 test984 test985 test986 \
 \
 test1000 test1001 test1002 test1003 test1004 test1005 test1006 test1007 \
 diff --git a/tests/data/test973 b/tests/data/test973
 new file mode 100644
-index 0000000..6ced107
+index 0000000..6fe6ce0
 --- /dev/null
 +++ b/tests/data/test973
-@@ -0,0 +1,88 @@
+@@ -0,0 +1,90 @@
 +<testcase>
 +<info>
 +<keywords>
@ -192,7 +264,7 @@ index 0000000..6ced107
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
-+Location: ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER0002
+Location: ftp://127.0.0.1:8992/a/path/9730002
 +
 +</data>
 +<data2>
@ -211,7 +283,7 @@ index 0000000..6ced107
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
-+Location: ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER0002
+Location: ftp://127.0.0.1:8992/a/path/9730002
 +
 +data
 +    to
@ -234,18 +306,20 @@ index 0000000..6ced107
 +HTTP with auth redirected to FTP w/o auth
 + </name>
 + <command>
-+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -L -u joe:secret
+http://%HOSTIP:%HTTPPORT/973 -L -u joe:secret
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<strip>
 +^User-Agent:.*
 +</strip>
 +<protocol>
-+GET /%TESTNUMBER HTTP/1.1
+GET /973 HTTP/1.1
 +Host: %HOSTIP:%HTTPPORT
 +Authorization: Basic am9lOnNlY3JldA==
 +User-Agent: curl/%VERSION
 +Accept: */*
 +
 +USER anonymous
@ -255,18 +329,18 @@ index 0000000..6ced107
 +CWD path
 +EPSV
 +TYPE I
-+SIZE %TESTNUMBER0002
+SIZE 9730002
-+RETR %TESTNUMBER0002
+RETR 9730002
 +QUIT
 +</protocol>
 +</verify>
 +</testcase>
 diff --git a/tests/data/test974 b/tests/data/test974
 new file mode 100644
-index 0000000..ac4e641
+index 0000000..de02d89
 --- /dev/null
 +++ b/tests/data/test974
-@@ -0,0 +1,87 @@
+@@ -0,0 +1,88 @@
 +<testcase>
 +<info>
 +<keywords>
@ -285,7 +359,7 @@ index 0000000..ac4e641
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
-+Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
+Location: http://firsthost.com:9999/a/path/9740002
 +
 +</data>
 +<data2>
@ -306,7 +380,7 @@ index 0000000..ac4e641
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
-+Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
+Location: http://firsthost.com:9999/a/path/9740002
 +
 +HTTP/1.1 200 OK
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
@ -337,17 +411,18 @@ index 0000000..ac4e641
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<strip>
 +^User-Agent:.*
 +</strip>
 +<protocol>
 +GET http://firsthost.com/ HTTP/1.1
 +Host: firsthost.com
 +Authorization: Basic am9lOnNlY3JldA==
 +User-Agent: curl/%VERSION
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +
-+GET http://firsthost.com:9999/a/path/%TESTNUMBER0002 HTTP/1.1
+GET http://firsthost.com:9999/a/path/9740002 HTTP/1.1
 +Host: firsthost.com:9999
 +User-Agent: curl/%VERSION
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +
@ -356,10 +431,10 @@ index 0000000..ac4e641
 +</testcase>
 diff --git a/tests/data/test975 b/tests/data/test975
 new file mode 100644
-index 0000000..85e03e4
+index 0000000..3a4eccf
 --- /dev/null
 +++ b/tests/data/test975
-@@ -0,0 +1,88 @@
+@@ -0,0 +1,90 @@
 +<testcase>
 +<info>
 +<keywords>
@ -379,7 +454,7 @@ index 0000000..85e03e4
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
-+Location: ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER0002
+Location: ftp://127.0.0.1:8992/a/path/9750002
 +
 +</data>
 +<data2>
@ -398,7 +473,7 @@ index 0000000..85e03e4
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
-+Location: ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER0002
+Location: ftp://127.0.0.1:8992/a/path/9750002
 +
 +data
 +    to
@ -421,18 +496,20 @@ index 0000000..85e03e4
 +HTTP with auth redirected to FTP allowing auth to continue
 + </name>
 + <command>
-+http://%HOSTIP:%HTTPPORT/%TESTNUMBER --location-trusted -u joe:secret
+http://%HOSTIP:%HTTPPORT/975 --location-trusted -u joe:secret
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<strip>
 +^User-Agent:.*
 +</strip>
 +<protocol>
-+GET /%TESTNUMBER HTTP/1.1
+GET /975 HTTP/1.1
 +Host: %HOSTIP:%HTTPPORT
 +Authorization: Basic am9lOnNlY3JldA==
 +User-Agent: curl/%VERSION
 +Accept: */*
 +
 +USER joe
@ -442,18 +519,18 @@ index 0000000..85e03e4
 +CWD path
 +EPSV
 +TYPE I
-+SIZE %TESTNUMBER0002
+SIZE 9750002
-+RETR %TESTNUMBER0002
+RETR 9750002
 +QUIT
 +</protocol>
 +</verify>
 +</testcase>
 diff --git a/tests/data/test976 b/tests/data/test976
 new file mode 100644
-index 0000000..c4dd61e
+index 0000000..3b6fac7
 --- /dev/null
 +++ b/tests/data/test976
-@@ -0,0 +1,88 @@
+@@ -0,0 +1,89 @@
 +<testcase>
 +<info>
 +<keywords>
@ -472,7 +549,7 @@ index 0000000..c4dd61e
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
-+Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
+Location: http://firsthost.com:9999/a/path/9760002
 +
 +</data>
 +<data2>
@ -493,7 +570,7 @@ index 0000000..c4dd61e
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
-+Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
+Location: http://firsthost.com:9999/a/path/9760002
 +
 +HTTP/1.1 200 OK
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
@ -524,18 +601,19 @@ index 0000000..c4dd61e
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<strip>
 +^User-Agent:.*
 +</strip>
 +<protocol>
 +GET http://firsthost.com/ HTTP/1.1
 +Host: firsthost.com
 +Authorization: Basic am9lOnNlY3JldA==
 +User-Agent: curl/%VERSION
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +
-+GET http://firsthost.com:9999/a/path/%TESTNUMBER0002 HTTP/1.1
+GET http://firsthost.com:9999/a/path/9760002 HTTP/1.1
 +Host: firsthost.com:9999
 +Authorization: Basic am9lOnNlY3JldA==
 +User-Agent: curl/%VERSION
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +
@ -546,7 +624,7 @@ index 0000000..c4dd61e
 2.34.1
-From 443ce415aa60caaf8b1c9b0b71fff8d26263daca Mon Sep 17 00:00:00 2001
+From cf98bd64b9949c50d4726eb26745c2f7fdf3a075 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 25 Apr 2022 17:59:15 +0200
 Subject: [PATCH 4/4] openssl: don't leak the SRP credentials in redirects
@ -566,10 +644,10 @@ Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 3 files changed, 13 insertions(+), 6 deletions(-)
 diff --git a/lib/http.c b/lib/http.c
-index 0791dcf..4433824 100644
+index 39fc7aa..d413738 100644
 --- a/lib/http.c
 +++ b/lib/http.c
-@@ -776,10 +776,10 @@ output_auth_headers(struct Curl_easy *data,
+@@ -689,10 +689,10 @@ output_auth_headers(struct connectdata *conn,
 }
 /*
@ -578,34 +656,34 @@ index 0791dcf..4433824 100644
 + * Curl_allow_auth_to_host() tells if authentication, cookies or other
 + * "sensitive data" can (still) be sent to this host.
  */
-static bool allow_auth_to_host(struct Curl_easy *data)
+-static bool allow_auth_to_host(struct connectdata *conn)
-+bool Curl_allow_auth_to_host(struct Curl_easy *data)
+bool Curl_allow_auth_to_host(struct connectdata *conn)
 {
-   struct connectdata *conn = data->conn;
+   struct Curl_easy *data = conn->data;
   return (!data->state.this_is_a_follow ||
-@@ -864,7 +864,7 @@ Curl_http_output_auth(struct Curl_easy *data,
+@@ -773,7 +773,7 @@ Curl_http_output_auth(struct connectdata *conn,
   /* To prevent the user+password to get sent to other than the original host
      due to a location-follow */
-  if(allow_auth_to_host(data)
+-  if(allow_auth_to_host(conn)
-+  if(Curl_allow_auth_to_host(data)
+  if(Curl_allow_auth_to_host(conn)
      || conn->bits.netrc)
-     result = output_auth_headers(data, conn, authhost, request, path, FALSE);
+     result = output_auth_headers(conn, authhost, request, path, FALSE);
   else
-@@ -1917,7 +1917,7 @@ CURLcode Curl_add_custom_headers(struct Curl_easy *data,
+@@ -1789,7 +1789,7 @@ CURLcode Curl_add_custom_headers(struct connectdata *conn,
-                    checkprefix("Cookie:", compare)) &&
+                    checkprefix("Cookie:", headers->data)) &&
                   /* be careful of sending this potentially sensitive header to
                      other hosts */
-                  !allow_auth_to_host(data))
+-                  !allow_auth_to_host(conn))
-+                  !Curl_allow_auth_to_host(data))
+                  !Curl_allow_auth_to_host(conn))
             ;
           else {
- #ifdef USE_HYPER
+             result = Curl_add_bufferf(req_buffer, "%s\r\n", headers->data);
 diff --git a/lib/http.h b/lib/http.h
-index 07e963d..9000bae 100644
+index 1d373e8..56a6061 100644
 --- a/lib/http.h
 +++ b/lib/http.h
-@@ -317,4 +317,10 @@ Curl_http_output_auth(struct Curl_easy *data,
+@@ -252,5 +252,11 @@ Curl_http_output_auth(struct connectdata *conn,
                       bool proxytunnel); /* TRUE if this is the request setting
                                             up the proxy tunnel */
@ -613,20 +691,21 @@ index 07e963d..9000bae 100644
 + * Curl_allow_auth_to_host() tells if authentication, cookies or other
 + * "sensitive data" can (still) be sent to this host.
 + */
-+bool Curl_allow_auth_to_host(struct Curl_easy *data);
+bool Curl_allow_auth_to_host(struct connectdata *conn);
 +
 #endif /* HEADER_CURL_HTTP_H */
 diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
-index 1bafe96..97c5666 100644
+index 28eaa6d..6c8faa2 100644
 --- a/lib/vtls/openssl.c
 +++ b/lib/vtls/openssl.c
-@@ -2857,7 +2857,8 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data,
+@@ -2499,7 +2499,8 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
 #endif
- #ifdef USE_OPENSSL_SRP
+ #ifdef USE_TLS_SRP
 -  if(ssl_authtype == CURL_TLSAUTH_SRP) {
 +  if((ssl_authtype == CURL_TLSAUTH_SRP) &&
-+     Curl_allow_auth_to_host(data)) {
+     Curl_allow_auth_to_host(conn)) {
     char * const ssl_username = SSL_SET_OPTION(username);
     infof(data, "Using TLS-SRP username: %s\n", ssl_username);
--- a/SOURCES/0039-curl-7.61.1-CVE-2022-27782.patch
+++ b/SOURCES/0039-curl-7.61.1-CVE-2022-27782.patch
@ -1,72 +1,7 @@
-From 50481ac42b4beae6ea85345e37b051124ac00f11 Mon Sep 17 00:00:00 2001
+From d4247fa7baf0859729fff2fe5cf0bfab8322d1a5 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Fri, 28 Jan 2022 16:48:38 +0100
 Subject: [PATCH 1/3] setopt: fix the TLSAUTH #ifdefs for proxy-disabled builds
 Closes #8350
 Upstream-commit: 96629ba2c212cda2bd1b7b04e2a9fc01ef70b75d
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/setopt.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)
 diff --git a/lib/setopt.c b/lib/setopt.c
 index 08827d1..9eaa187 100644
 --- a/lib/setopt.c
 +++ b/lib/setopt.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
 - * Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al.
 + * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -2699,30 +2699,30 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
     if(data->set.str[STRING_TLSAUTH_USERNAME] && !data->set.ssl.authtype)
       data->set.ssl.authtype = CURL_TLSAUTH_SRP; /* default to SRP */
     break;
 +#ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_TLSAUTH_USERNAME:
     result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_USERNAME_PROXY],
                             va_arg(param, char *));
 -#ifndef CURL_DISABLE_PROXY
     if(data->set.str[STRING_TLSAUTH_USERNAME_PROXY] &&
        !data->set.proxy_ssl.authtype)
       data->set.proxy_ssl.authtype = CURL_TLSAUTH_SRP; /* default to SRP */
 -#endif
     break;
 +#endif
   case CURLOPT_TLSAUTH_PASSWORD:
     result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_PASSWORD],
                             va_arg(param, char *));
     if(data->set.str[STRING_TLSAUTH_USERNAME] && !data->set.ssl.authtype)
       data->set.ssl.authtype = CURL_TLSAUTH_SRP; /* default to SRP */
     break;
 +#ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_TLSAUTH_PASSWORD:
     result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_PASSWORD_PROXY],
                             va_arg(param, char *));
 -#ifndef CURL_DISABLE_PROXY
     if(data->set.str[STRING_TLSAUTH_USERNAME_PROXY] &&
        !data->set.proxy_ssl.authtype)
       data->set.proxy_ssl.authtype = CURL_TLSAUTH_SRP; /* default to SRP */
 -#endif
     break;
 +#endif
   case CURLOPT_TLSAUTH_TYPE:
     argptr = va_arg(param, char *);
     if(!argptr ||
 -- 
 2.34.1
 From 931fbabcae0b5d1a91657e6bb85f4f23fce7ac3d Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 9 May 2022 23:13:53 +0200
-Subject: [PATCH 2/3] tls: check more TLS details for connection reuse
+Subject: [PATCH 1/2] tls: check more TLS details for connection reuse
 CVE-2022-27782
@ -78,33 +13,33 @@ Upstream-commit: f18af4f874cecab82a9797e8c7541e0990c7a64c
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/setopt.c       | 29 +++++++++++++++++------------
- lib/url.c          | 23 ++++++++++++++++-------
+ lib/url.c          | 19 ++++++++++++-------
- lib/urldata.h      | 13 +++++++------
+ lib/urldata.h      | 14 +++++++-------
 lib/vtls/openssl.c | 10 +++++-----
 lib/vtls/vtls.c    | 21 +++++++++++++++++++++
- 5 files changed, 66 insertions(+), 30 deletions(-)
+ 5 files changed, 62 insertions(+), 31 deletions(-)
 diff --git a/lib/setopt.c b/lib/setopt.c
-index 8e1bf12..7aa6fdb 100644
+index b07ccfe..319a010 100644
 --- a/lib/setopt.c
 +++ b/lib/setopt.c
-@@ -2268,6 +2268,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
+@@ -2044,6 +2044,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
   case CURLOPT_SSL_OPTIONS:
     arg = va_arg(param, long);
 +    data->set.ssl.primary.ssl_options = (unsigned char)(arg & 0xff);
-     data->set.ssl.enable_beast =
+     data->set.ssl.enable_beast = arg&CURLSSLOPT_ALLOW_BEAST?TRUE:FALSE;
       (bool)((arg&CURLSSLOPT_ALLOW_BEAST) ? TRUE : FALSE);
     data->set.ssl.no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE);
-@@ -2281,6 +2282,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
+     data->set.ssl.no_partialchain = !!(arg & CURLSSLOPT_NO_PARTIALCHAIN);
- #ifndef CURL_DISABLE_PROXY
+@@ -2051,6 +2052,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
   case CURLOPT_PROXY_SSL_OPTIONS:
     arg = va_arg(param, long);
 +    data->set.proxy_ssl.primary.ssl_options = (unsigned char)(arg & 0xff);
-     data->set.proxy_ssl.enable_beast =
+     data->set.proxy_ssl.enable_beast = arg&CURLSSLOPT_ALLOW_BEAST?TRUE:FALSE;
       (bool)((arg&CURLSSLOPT_ALLOW_BEAST) ? TRUE : FALSE);
     data->set.proxy_ssl.no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE);
-@@ -2696,49 +2698,52 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
+     break;
@@ -2451,44 +2453,47 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
   case CURLOPT_TLSAUTH_USERNAME:
     result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_USERNAME],
                             va_arg(param, char *));
@ -114,7 +49,6 @@ index 8e1bf12..7aa6fdb 100644
 +       !data->set.ssl.primary.authtype)
 +      data->set.ssl.primary.authtype = CURL_TLSAUTH_SRP; /* default to SRP */
     break;
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_TLSAUTH_USERNAME:
     result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_USERNAME_PROXY],
                             va_arg(param, char *));
@ -125,7 +59,6 @@ index 8e1bf12..7aa6fdb 100644
 +      data->set.proxy_ssl.primary.authtype = CURL_TLSAUTH_SRP; /* default to
 +                                                                  SRP */
     break;
 #endif
   case CURLOPT_TLSAUTH_PASSWORD:
     result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_PASSWORD],
                             va_arg(param, char *));
@ -135,7 +68,6 @@ index 8e1bf12..7aa6fdb 100644
 +       !data->set.ssl.primary.authtype)
 +      data->set.ssl.primary.authtype = CURL_TLSAUTH_SRP; /* default */
     break;
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_TLSAUTH_PASSWORD:
     result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_PASSWORD_PROXY],
                             va_arg(param, char *));
@ -145,7 +77,6 @@ index 8e1bf12..7aa6fdb 100644
 +       !data->set.proxy_ssl.primary.authtype)
 +      data->set.proxy_ssl.primary.authtype = CURL_TLSAUTH_SRP; /* default */
     break;
 #endif
   case CURLOPT_TLSAUTH_TYPE:
     argptr = va_arg(param, char *);
     if(!argptr ||
@ -156,7 +87,6 @@ index 8e1bf12..7aa6fdb 100644
 -      data->set.ssl.authtype = CURL_TLSAUTH_NONE;
 +      data->set.ssl.primary.authtype = CURL_TLSAUTH_NONE;
     break;
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_TLSAUTH_TYPE:
     argptr = va_arg(param, char *);
     if(!argptr ||
@ -168,12 +98,12 @@ index 8e1bf12..7aa6fdb 100644
 +      data->set.proxy_ssl.primary.authtype = CURL_TLSAUTH_NONE;
     break;
 #endif
- #endif
+   case CURLOPT_DNS_SERVERS:
 diff --git a/lib/url.c b/lib/url.c
-index 94e3406..5ebf5e2 100644
+index 7dd5267..30fc5ad 100644
 --- a/lib/url.c
 +++ b/lib/url.c
-@@ -540,7 +540,7 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
+@@ -461,7 +461,7 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
   set->ssl.primary.verifypeer = TRUE;
   set->ssl.primary.verifyhost = TRUE;
 #ifdef USE_TLS_SRP
@ -182,147 +112,132 @@ index 94e3406..5ebf5e2 100644
 #endif
   set->ssh_auth_types = CURLSSH_AUTH_DEFAULT; /* defaults to any auth
                                                       type */
-@@ -1719,11 +1719,17 @@ static struct connectdata *allocate_conn(struct Curl_easy *data)
+@@ -1881,10 +1881,12 @@ static struct connectdata *allocate_conn(struct Curl_easy *data)
   conn->ssl_config.verifystatus = data->set.ssl.primary.verifystatus;
   conn->ssl_config.verifypeer = data->set.ssl.primary.verifypeer;
   conn->ssl_config.verifyhost = data->set.ssl.primary.verifyhost;
 +  conn->ssl_config.ssl_options = data->set.ssl.primary.ssl_options;
 +#ifdef USE_TLS_SRP
 +#endif
 #ifndef CURL_DISABLE_PROXY
   conn->proxy_ssl_config.verifystatus =
     data->set.proxy_ssl.primary.verifystatus;
   conn->proxy_ssl_config.verifypeer = data->set.proxy_ssl.primary.verifypeer;
   conn->proxy_ssl_config.verifyhost = data->set.proxy_ssl.primary.verifyhost;
 +  conn->proxy_ssl_config.ssl_options = data->set.proxy_ssl.primary.ssl_options;
-+#ifdef USE_TLS_SRP
+ 
 +#endif
 #endif
   conn->ip_version = data->set.ipver;
-   conn->bits.connect_only = data->set.connect_only;
+ 
-@@ -3764,7 +3770,8 @@ static CURLcode create_conn(struct Curl_easy *data,
+@@ -4362,8 +4364,9 @@ static CURLcode create_conn(struct Curl_easy *data,
-     data->set.str[STRING_SSL_ISSUERCERT_PROXY];
+   data->set.proxy_ssl.primary.cipher_list13 =
-   data->set.proxy_ssl.primary.issuercert_blob =
+     data->set.str[STRING_SSL_CIPHER13_LIST_PROXY];
-     data->set.blobs[BLOB_SSL_ISSUERCERT_PROXY];
+ 
 -  data->set.ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE];
 -  data->set.proxy_ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE_PROXY];
 +  data->set.ssl.primary.CRLfile = data->set.str[STRING_SSL_CRLFILE];
 +  data->set.proxy_ssl.primary.CRLfile =
 +    data->set.str[STRING_SSL_CRLFILE_PROXY];
-   data->set.proxy_ssl.cert_type = data->set.str[STRING_CERT_TYPE_PROXY];
+   data->set.ssl.cert = data->set.str[STRING_CERT];
-   data->set.proxy_ssl.key = data->set.str[STRING_KEY_PROXY];
+   data->set.proxy_ssl.cert = data->set.str[STRING_CERT_PROXY];
   data->set.proxy_ssl.key_type = data->set.str[STRING_KEY_TYPE_PROXY];
@@ -3772,18 +3779,20 @@ static CURLcode create_conn(struct Curl_easy *data,
   data->set.proxy_ssl.primary.clientcert = data->set.str[STRING_CERT_PROXY];
   data->set.proxy_ssl.key_blob = data->set.blobs[BLOB_KEY_PROXY];
 #endif
 -  data->set.ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE];
 +  data->set.ssl.primary.CRLfile = data->set.str[STRING_SSL_CRLFILE];
   data->set.ssl.cert_type = data->set.str[STRING_CERT_TYPE];
-   data->set.ssl.key = data->set.str[STRING_KEY];
+@@ -4377,10 +4380,12 @@ static CURLcode create_conn(struct Curl_easy *data,
   data->set.ssl.key_type = data->set.str[STRING_KEY_TYPE];
   data->set.ssl.key_passwd = data->set.str[STRING_KEY_PASSWD];
   data->set.ssl.primary.clientcert = data->set.str[STRING_CERT];
   data->set.proxy_ssl.primary.clientcert = data->set.str[STRING_CERT_PROXY];
 #ifdef USE_TLS_SRP
 -  data->set.ssl.username = data->set.str[STRING_TLSAUTH_USERNAME];
 -  data->set.proxy_ssl.username = data->set.str[STRING_TLSAUTH_USERNAME_PROXY];
 -  data->set.ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD];
 -  data->set.proxy_ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD_PROXY];
 +  data->set.ssl.primary.username = data->set.str[STRING_TLSAUTH_USERNAME];
 +  data->set.ssl.primary.password = data->set.str[STRING_TLSAUTH_PASSWORD];
 #ifndef CURL_DISABLE_PROXY
 -  data->set.proxy_ssl.username = data->set.str[STRING_TLSAUTH_USERNAME_PROXY];
 -  data->set.proxy_ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD_PROXY];
 +  data->set.proxy_ssl.primary.username =
 +    data->set.str[STRING_TLSAUTH_USERNAME_PROXY];
 +  data->set.proxy_ssl.primary.password =
 +    data->set.str[STRING_TLSAUTH_PASSWORD_PROXY];
 #endif
- #endif
+ 
-   data->set.ssl.key_blob = data->set.blobs[BLOB_KEY];
+   if(!Curl_clone_primary_ssl_config(&data->set.ssl.primary,
 diff --git a/lib/urldata.h b/lib/urldata.h
-index 5218f76..e006495 100644
+index 026684b..0e48841 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
-@@ -253,9 +253,16 @@ struct ssl_primary_config {
+@@ -229,6 +229,13 @@ struct ssl_primary_config {
   char *egdsocket;       /* path to file containing the EGD daemon socket */
   char *cipher_list;     /* list of ciphers to use */
   char *cipher_list13;   /* list of TLS 1.3 cipher suites to use */
   char *pinned_key;
 +  char *CRLfile;         /* CRL to check certificate revocation */
   struct curl_blob *cert_blob;
   struct curl_blob *issuercert_blob;
 +#ifdef USE_TLS_SRP
 +  char *username; /* TLS username (for, e.g., SRP) */
 +  char *password; /* TLS password (for, e.g., SRP) */
 +  enum CURL_TLSAUTH authtype; /* TLS authentication type (default SRP) */
 +#endif
   char *curves;          /* list of curves to use */
 +  unsigned char ssl_options;  /* the CURLOPT_SSL_OPTIONS bitmask */
-   BIT(verifypeer);       /* set TRUE if this is desired */
+ };
-   BIT(verifyhost);       /* set TRUE if CN/SAN must match hostname */
+ 
   BIT(verifystatus);     /* set TRUE if certificate status must be checked */
@@ -265,7 +272,6 @@ struct ssl_primary_config {
 struct ssl_config_data {
-   struct ssl_primary_config primary;
+@@ -238,7 +245,6 @@ struct ssl_config_data {
   bool no_revoke;    /* disable SSL certificate revocation checks */
   bool no_partialchain;  /* don't accept partial certificate chains */
   long certverifyresult; /* result from the certificate verification */
 -  char *CRLfile;   /* CRL to check certificate revocation */
   curl_ssl_ctx_callback fsslctx; /* function to initialize ssl ctx */
   void *fsslctxp;        /* parameter for call back */
-   char *cert_type; /* format for certificate (default: PEM)*/
+   bool certinfo;         /* gather lots of certificate info */
-@@ -273,11 +279,6 @@ struct ssl_config_data {
+@@ -249,12 +255,6 @@ struct ssl_config_data {
-   struct curl_blob *key_blob;
+   char *key; /* private key file name */
   char *key_type; /* format for private key (default: PEM) */
   char *key_passwd; /* plain text private key password */
 -
 -#ifdef USE_TLS_SRP
 -  char *username; /* TLS username (for, e.g., SRP) */
 -  char *password; /* TLS password (for, e.g., SRP) */
 -  enum CURL_TLSAUTH authtype; /* TLS authentication type (default SRP) */
 -#endif
-   BIT(certinfo);     /* gather lots of certificate info */
+ };
-   BIT(falsestart);
+ 
-   BIT(enable_beast); /* allow this flaw for interoperability's sake*/
+ struct ssl_general_config {
 diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
-index 97c5666..a4ef9d1 100644
+index 6c8faa2..75ff8d8 100644
 --- a/lib/vtls/openssl.c
 +++ b/lib/vtls/openssl.c
-@@ -2546,7 +2546,7 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data,
+@@ -2232,14 +2232,14 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
- #endif
+     &data->set.proxy_ssl.certverifyresult : &data->set.ssl.certverifyresult;
   const long int ssl_version = SSL_CONN_CONFIG(version);
- #ifdef USE_OPENSSL_SRP
+ #ifdef USE_TLS_SRP
 -  const enum CURL_TLSAUTH ssl_authtype = SSL_SET_OPTION(authtype);
 +  const enum CURL_TLSAUTH ssl_authtype = SSL_SET_OPTION(primary.authtype);
 #endif
-   char * const ssl_cert = SSL_SET_OPTION(primary.clientcert);
+   char * const ssl_cert = SSL_SET_OPTION(cert);
-   const struct curl_blob *ssl_cert_blob = SSL_SET_OPTION(primary.cert_blob);
+   const char * const ssl_cert_type = SSL_SET_OPTION(cert_type);
@@ -2554,7 +2554,7 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data,
   const char * const ssl_cafile = SSL_CONN_CONFIG(CAfile);
   const char * const ssl_capath = SSL_CONN_CONFIG(CApath);
   const bool verifypeer = SSL_CONN_CONFIG(verifypeer);
 -  const char * const ssl_crlfile = SSL_SET_OPTION(CRLfile);
 +  const char * const ssl_crlfile = SSL_SET_OPTION(primary.CRLfile);
   char error_buffer[256];
-   struct ssl_backend_data *backend = connssl->backend;
+ 
-   bool imported_native_ca = false;
+   DEBUGASSERT(ssl_connect_1 == connssl->connecting_state);
-@@ -2859,15 +2859,15 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data,
+@@ -2501,15 +2501,15 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
- #ifdef USE_OPENSSL_SRP
+ #ifdef USE_TLS_SRP
   if((ssl_authtype == CURL_TLSAUTH_SRP) &&
-      Curl_allow_auth_to_host(data)) {
+      Curl_allow_auth_to_host(conn)) {
 -    char * const ssl_username = SSL_SET_OPTION(username);
 -
 +    char * const ssl_username = SSL_SET_OPTION(primary.username);
 +    char * const ssl_password = SSL_SET_OPTION(primary.password);
     infof(data, "Using TLS-SRP username: %s\n", ssl_username);
-     if(!SSL_CTX_set_srp_username(backend->ctx, ssl_username)) {
+     if(!SSL_CTX_set_srp_username(BACKEND->ctx, ssl_username)) {
       failf(data, "Unable to set SRP user name");
       return CURLE_BAD_FUNCTION_ARGUMENT;
     }
-    if(!SSL_CTX_set_srp_password(backend->ctx, SSL_SET_OPTION(password))) {
+-    if(!SSL_CTX_set_srp_password(BACKEND->ctx, SSL_SET_OPTION(password))) {
-+    if(!SSL_CTX_set_srp_password(backend->ctx, ssl_password)) {
+    if(!SSL_CTX_set_srp_password(BACKEND->ctx, ssl_password)) {
       failf(data, "failed setting SRP password");
       return CURLE_BAD_FUNCTION_ARGUMENT;
     }
 diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
-index a40ac06..e2d3438 100644
+index bdff93f..2b14fa6 100644
 --- a/lib/vtls/vtls.c
 +++ b/lib/vtls/vtls.c
-@@ -132,6 +132,7 @@ Curl_ssl_config_matches(struct ssl_primary_config *data,
+@@ -88,6 +88,7 @@ Curl_ssl_config_matches(struct ssl_primary_config* data,
 {
   if((data->version == needle->version) &&
      (data->version_max == needle->version_max) &&
@ -330,7 +245,7 @@ index a40ac06..e2d3438 100644
      (data->verifypeer == needle->verifypeer) &&
      (data->verifyhost == needle->verifyhost) &&
      (data->verifystatus == needle->verifystatus) &&
-@@ -143,9 +144,15 @@ Curl_ssl_config_matches(struct ssl_primary_config *data,
+@@ -96,6 +97,12 @@ Curl_ssl_config_matches(struct ssl_primary_config* data,
      Curl_safecmp(data->clientcert, needle->clientcert) &&
      Curl_safecmp(data->random_file, needle->random_file) &&
      Curl_safecmp(data->egdsocket, needle->egdsocket) &&
@ -339,14 +254,11 @@ index a40ac06..e2d3438 100644
 +     Curl_safecmp(data->password, needle->password) &&
 +     (data->authtype == needle->authtype) &&
 +#endif
      Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) &&
      Curl_safe_strcasecompare(data->cipher_list13, needle->cipher_list13) &&
      Curl_safe_strcasecompare(data->curves, needle->curves) &&
 +     Curl_safe_strcasecompare(data->CRLfile, needle->CRLfile) &&
-      Curl_safe_strcasecompare(data->pinned_key, needle->pinned_key))
+      Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) &&
      Curl_safe_strcasecompare(data->cipher_list13, needle->cipher_list13))
     return TRUE;
- 
+@@ -113,6 +120,10 @@ Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
@@ -162,6 +169,10 @@ Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
   dest->verifyhost = source->verifyhost;
   dest->verifystatus = source->verifystatus;
   dest->sessionid = source->sessionid;
@ -355,12 +267,12 @@ index a40ac06..e2d3438 100644
 +  dest->authtype = source->authtype;
 +#endif
-   CLONE_BLOB(cert_blob);
+   CLONE_STRING(CApath);
-   CLONE_BLOB(issuercert_blob);
+   CLONE_STRING(CAfile);
-@@ -175,6 +186,11 @@ Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
+@@ -122,6 +133,11 @@ Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
   CLONE_STRING(egdsocket);
   CLONE_STRING(cipher_list);
   CLONE_STRING(cipher_list13);
   CLONE_STRING(pinned_key);
   CLONE_STRING(curves);
 +  CLONE_STRING(CRLfile);
 +#ifdef USE_TLS_SRP
 +  CLONE_STRING(username);
@ -369,10 +281,10 @@ index a40ac06..e2d3438 100644
   return TRUE;
 }
-@@ -193,6 +209,11 @@ void Curl_free_primary_ssl_config(struct ssl_primary_config *sslc)
+@@ -136,6 +152,11 @@ void Curl_free_primary_ssl_config(struct ssl_primary_config* sslc)
-   Curl_safefree(sslc->cert_blob);
+   Curl_safefree(sslc->egdsocket);
-   Curl_safefree(sslc->issuercert_blob);
+   Curl_safefree(sslc->cipher_list);
-   Curl_safefree(sslc->curves);
+   Curl_safefree(sslc->cipher_list13);
 +  Curl_safefree(sslc->CRLfile);
 +#ifdef USE_TLS_SRP
 +  Curl_safefree(sslc->username);
@ -385,10 +297,10 @@ index a40ac06..e2d3438 100644
 2.34.1
-From 5e9832048b30492e02dd222cd8bfe997e03cffa1 Mon Sep 17 00:00:00 2001
+From a9cf46e6c6c9a4261f3ea8500dfef87c1436908b Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 9 May 2022 23:13:53 +0200
-Subject: [PATCH 3/3] url: check SSH config match on connection reuse
+Subject: [PATCH 2/2] url: check SSH config match on connection reuse
 CVE-2022-27782
@ -399,18 +311,33 @@ Closes #8825
 Upstream-commit: 1645e9b44505abd5cbaf65da5282c3f33b5924a5
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/ssh.h |  4 ++--
 lib/url.c | 11 +++++++++++
- lib/vssh/ssh.h |  6 +++---
+ 2 files changed, 13 insertions(+), 2 deletions(-)
 2 files changed, 14 insertions(+), 3 deletions(-)
 diff --git a/lib/ssh.h b/lib/ssh.h
 index 0620aac..1114f8a 100644
 --- a/lib/ssh.h
 +++ b/lib/ssh.h
@@ -117,8 +117,8 @@ struct ssh_conn {
   /* common */
   const char *passphrase;     /* pass-phrase to use */
 -  char *rsa_pub;              /* path name */
 -  char *rsa;                  /* path name */
 +  char *rsa_pub;              /* strdup'ed public key file */
 +  char *rsa;                  /* strdup'ed private key file */
   bool authed;                /* the connection has been authenticated fine */
   sshstate state;             /* always use ssh.c:state() to change state! */
   sshstate nextstate;         /* the state to goto after stopping */
 diff --git a/lib/url.c b/lib/url.c
-index 5ebf5e2..c713e54 100644
+index 30fc5ad..8653ebb 100644
 --- a/lib/url.c
 +++ b/lib/url.c
-@@ -1073,6 +1073,12 @@ static void prune_dead_connections(struct Curl_easy *data)
+@@ -1030,6 +1030,12 @@ static size_t max_pipeline_length(struct Curl_multi *multi)
   }
 }
 +static bool ssh_config_matches(struct connectdata *one,
 +                               struct connectdata *two)
 +{
@ -420,42 +347,18 @@ index 5ebf5e2..c713e54 100644
 /*
  * Given one filled in connection struct (named needle), this function should
  * detect if there already is one that has all the significant details
-@@ -1319,6 +1325,11 @@ ConnectionExists(struct Curl_easy *data,
+@@ -1299,6 +1305,11 @@ ConnectionExists(struct Curl_easy *data,
         }
       }
-+      if(get_protocol_family(needle->handler) == PROTO_FAMILY_SSH) {
+      if(needle->handler->protocol & (CURLPROTO_SCP|CURLPROTO_SFTP)) {
 +        if(!ssh_config_matches(needle, check))
 +          continue;
 +      }
 +
-       if((needle->handler->flags&PROTOPT_SSL)
+       if(!needle->bits.httpproxy || (needle->handler->flags&PROTOPT_SSL) ||
- #ifndef CURL_DISABLE_PROXY
+          needle->bits.tunnel_proxy) {
-          || !needle->bits.httpproxy || needle->bits.tunnel_proxy
+         /* The requested connection does not use a HTTP proxy or it uses SSL or
 diff --git a/lib/vssh/ssh.h b/lib/vssh/ssh.h
 index 7972081..30d82e5 100644
 --- a/lib/vssh/ssh.h
 +++ b/lib/vssh/ssh.h
@@ -7,7 +7,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
 - * Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al.
 + * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -131,8 +131,8 @@ struct ssh_conn {
   /* common */
   const char *passphrase;     /* pass-phrase to use */
 -  char *rsa_pub;              /* path name */
 -  char *rsa;                  /* path name */
 +  char *rsa_pub;              /* strdup'ed public key file */
 +  char *rsa;                  /* strdup'ed private key file */
   bool authed;                /* the connection has been authenticated fine */
   bool acceptfail;            /* used by the SFTP_QUOTE (continue if
                                  quote command fails) */
 -- 
 2.34.1
--- a/SOURCES/0040-curl-7.61.1-CVE-2022-32208.patch
+++ b/SOURCES/0040-curl-7.61.1-CVE-2022-32208.patch
@ -11,14 +11,15 @@ Closes #9051
 Upstream-commit: 6ecdf5136b52af747e7bda08db9a748256b1cd09
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
- lib/krb5.c | 18 +++++++++++-------
+ lib/krb5.c     |  5 +----
- 1 file changed, 11 insertions(+), 7 deletions(-)
+ lib/security.c | 19 +++++++++++++++----
 2 files changed, 16 insertions(+), 8 deletions(-)
 diff --git a/lib/krb5.c b/lib/krb5.c
 index 787137c..6f9e1f7 100644
 --- a/lib/krb5.c
 +++ b/lib/krb5.c
-@@ -146,11 +146,8 @@ krb5_decode(void *app_data, void *buf, int len,
+@@ -86,11 +86,8 @@ krb5_decode(void *app_data, void *buf, int len,
   enc.value = buf;
   enc.length = len;
   maj = gss_unwrap(&min, *context, &enc, &dec, NULL, NULL);
@ -31,7 +32,22 @@ index 787137c..6f9e1f7 100644
   memcpy(buf, dec.value, dec.length);
   len = curlx_uztosi(dec.length);
-@@ -523,6 +520,7 @@ static CURLcode read_data(struct connectdata *conn,
+diff --git a/lib/security.c b/lib/security.c
 index 52cce97..c95f290 100644
 --- a/lib/security.c
 +++ b/lib/security.c
@@ -64,6 +64,10 @@
 /* The last #include file should be: */
 #include "memdebug.h"
 +/* Max string input length is a precaution against abuse and to detect junk
 +   input easier and better. */
 +#define CURL_MAX_INPUT_LENGTH 8000000
 +
 static const struct {
   enum protection_level level;
   const char *name;
@@ -192,6 +196,7 @@ static CURLcode read_data(struct connectdata *conn,
 {
   int len;
   CURLcode result;
@ -39,7 +55,7 @@ index 787137c..6f9e1f7 100644
   result = socket_read(fd, &len, sizeof(len));
   if(result)
-@@ -531,7 +529,10 @@ static CURLcode read_data(struct connectdata *conn,
+@@ -200,7 +205,10 @@ static CURLcode read_data(struct connectdata *conn,
   if(len) {
     /* only realloc if there was a length */
     len = ntohl(len);
@ -51,7 +67,7 @@ index 787137c..6f9e1f7 100644
   }
   if(!len || !buf->data)
     return CURLE_OUT_OF_MEMORY;
-@@ -539,8 +540,11 @@ static CURLcode read_data(struct connectdata *conn,
+@@ -208,8 +216,11 @@ static CURLcode read_data(struct connectdata *conn,
   result = socket_read(fd, buf->data, len);
   if(result)
     return result;
--- a/SOURCES/0041-curl-7.61.1-CVE-2022-32206.patch
+++ b/SOURCES/0041-curl-7.61.1-CVE-2022-32206.patch
@ -21,7 +21,7 @@ diff --git a/lib/content_encoding.c b/lib/content_encoding.c
 index c03637a..6f994b3 100644
 --- a/lib/content_encoding.c
 +++ b/lib/content_encoding.c
-@@ -1024,12 +1024,16 @@ static const struct content_encoding *find_encoding(const char *name,
+@@ -934,6 +934,9 @@ static const content_encoding *find_encoding(const char *name, size_t len)
   return NULL;
 }
@ -30,15 +30,16 @@ index c03637a..6f994b3 100644
 +
 /* Set-up the unencoding stack from the Content-Encoding header value.
  * See RFC 7231 section 3.1.2.2. */
- CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
+ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
-                                      const char *enclist, int maybechunked)
+@@ -941,6 +944,7 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
 {
   struct Curl_easy *data = conn->data;
   struct SingleRequest *k = &data->req;
 +  int counter = 0;
   do {
     const char *name;
-@@ -1064,6 +1068,11 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
+@@ -975,6 +979,11 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
       if(!encoding)
         encoding = &error_encoding;  /* Defer error at stack use. */
@ -48,7 +49,7 @@ index c03637a..6f994b3 100644
 +        return CURLE_BAD_CONTENT_ENCODING;
 +      }
       /* Stack the unencoding stage. */
-       writer = new_unencoding_writer(data, encoding, k->writer_stack);
+       writer = new_unencoding_writer(conn, encoding, k->writer_stack);
       if(!writer)
 -- 
 2.35.3
@ -71,12 +72,12 @@ diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
 index 98d5516..9b5f4fb 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
-@@ -62,6 +62,7 @@ test343 test344 test345 test346 test347 test348 test349 test350 test351 \
+@@ -61,6 +61,7 @@ test325 test326 test330 \
- test352 test353 test354 test355 test356 test357 test358 test359 test360 \
+ test340 \
 test361 test362 \
 \
 test350 test351 test352 test353 test354 \
 +test387 \
- test393 test394 test395 test396 test397 \
+ test393 test394 test395 \
 \
 test400 test401 test402 test403 test404 test405 test406 test407 test408 \
 diff --git a/tests/data/test387 b/tests/data/test387
@ -124,7 +125,7 @@ index 0000000..015ec25
 +<protocol>
 +GET /%TESTNUMBER HTTP/1.1
 +Host: %HOSTIP:%HTTPPORT
-+User-Agent: curl/%VERSION
+User-Agent: curl/7.61.1
 +Accept: */*
 +
 +</protocol>
--- a/SOURCES/0042-curl-7.61.1-ssh-known-hosts.patch
+++ b/SOURCES/0042-curl-7.61.1-ssh-known-hosts.patch
@ -0,0 +1,43 @@
 From 9ea407a0476d22cde575826c18b5aa56b57ac9b4 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Felix=20H=C3=A4dicke?= <felixhaedicke@web.de>
 Date: Wed, 23 Jan 2019 23:10:39 +0100
 Subject: [PATCH] setopt: enable CURLOPT_SSH_KNOWNHOSTS and
 CURLOPT_SSH_KEYFUNCTION for libssh
 CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION are supported for
 libssh as well. So accepting these options only when compiling with
 libssh2 is wrong here.
 Fixes #3493
 Closes #3494
 Upstream-commit: 3cbf731d9ec7146f9f1a6ac0fbd9af7fe358f5bb
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/setopt.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
 diff --git a/lib/setopt.c b/lib/setopt.c
 index b07ccfe..88a05ff 100644
 --- a/lib/setopt.c
 +++ b/lib/setopt.c
@@ -2208,7 +2208,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
     result = Curl_setstropt(&data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5],
                             va_arg(param, char *));
     break;
 -#ifdef HAVE_LIBSSH2_KNOWNHOST_API
 +
   case CURLOPT_SSH_KNOWNHOSTS:
     /*
      * Store the file name to read known hosts from.
@@ -2229,7 +2229,6 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
      */
     data->set.ssh_keyfunc_userp = va_arg(param, void *);
     break;
 -#endif /* HAVE_LIBSSH2_KNOWNHOST_API */
 #endif /* USE_LIBSSH2 */
   case CURLOPT_HTTP_TRANSFER_DECODING:
 -- 
 2.34.1
--- a/SOURCES/0043-curl-7.61.1-CVE-2022-35252.patch
+++ b/SOURCES/0043-curl-7.61.1-CVE-2022-35252.patch
@ -1,7 +1,42 @@
 From 005d3f387bc5c3b2ee94d0597b5e202644c825f5 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Wed, 31 Oct 2018 11:08:49 +0100
 Subject: [PATCH 1/3] runtests: use the local curl for verifying
 ... revert the mistaken change brought in commit 8440616f53.
 Reported-by: Alessandro Ghedini
 Bug: https://curl.haxx.se/mail/lib-2018-10/0118.html
 Closes #3198
 Upstream-commit: 8effa8c2b09906a2f00a3f08322dc5da35245b0a
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/runtests.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/tests/runtests.pl b/tests/runtests.pl
 index 8d8ed81..d62fa40 100755
 --- a/tests/runtests.pl
 +++ b/tests/runtests.pl
@@ -152,7 +152,7 @@ my $NEGTELNETPORT;       # TELNET server port with negotiation
 my $srcdir = $ENV{'srcdir'} || '.';
 my $CURL="../src/curl".exe_ext(); # what curl executable to run on the tests
 -my $VCURL="curl";   # what curl binary to use to verify the servers with
 +my $VCURL=$CURL;   # what curl binary to use to verify the servers with
                    # VCURL is handy to set to the system one when the one you
                    # just built hangs or crashes and thus prevent verification
 my $DBGCURL=$CURL; #"../src/.libs/curl";  # alternative for debugging
 -- 
 2.37.3
 From fbc2ac6f06ec13cc872ce7adb870f4d7c7d5dded Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 29 Aug 2022 00:09:17 +0200
-Subject: [PATCH 1/2] cookie: reject cookies with "control bytes"
+Subject: [PATCH 2/3] cookie: reject cookies with "control bytes"
 Rejects 0x01 - 0x1f (except 0x09) plus 0x7f
@ -23,7 +58,7 @@ diff --git a/lib/cookie.c b/lib/cookie.c
 index cb0c03b..e0470a1 100644
 --- a/lib/cookie.c
 +++ b/lib/cookie.c
-@@ -383,6 +383,30 @@ static void strstore(char **str, const char *newstr)
+@@ -371,6 +371,30 @@ static void strstore(char **str, const char *newstr)
   *str = strdup(newstr);
 }
@ -54,7 +89,7 @@ index cb0c03b..e0470a1 100644
 /*
  * remove_expired() removes expired cookies.
  */
-@@ -567,6 +591,11 @@ Curl_cookie_add(struct Curl_easy *data,
+@@ -541,6 +565,11 @@ Curl_cookie_add(struct Curl_easy *data,
             badcookie = TRUE;
             break;
           }
@ -73,7 +108,7 @@ index cb0c03b..e0470a1 100644
 From 1a3e2bd48572761236934651091c899a4d460ef5 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 29 Aug 2022 00:09:17 +0200
-Subject: [PATCH 2/2] test8: verify that "ctrl-byte cookies" are ignored
+Subject: [PATCH 3/3] test8: verify that "ctrl-byte cookies" are ignored
 Upstream-commit: 2fc031d834d488854ffc58bf7dbcef7fa7c1fc28
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
@ -89,42 +124,42 @@ index a8548e6..8587611 100644
 Set-Cookie: nocookie=yes; path=/WE;
 Set-Cookie: blexp=yesyes; domain=%HOSTIP; domain=%HOSTIP; expiry=totally bad;
 Set-Cookie: partialip=nono; domain=.0.0.1;
-+Set-Cookie: cookie1=%hex[%01-junk]hex%
+Set-Cookie: cookie1=-junk
-+Set-Cookie: cookie2=%hex[%02-junk]hex%
+Set-Cookie: cookie2=-junk
-+Set-Cookie: cookie3=%hex[%03-junk]hex%
+Set-Cookie: cookie3=-junk
-+Set-Cookie: cookie4=%hex[%04-junk]hex%
+Set-Cookie: cookie4=-junk
-+Set-Cookie: cookie5=%hex[%05-junk]hex%
+Set-Cookie: cookie5=-junk
-+Set-Cookie: cookie6=%hex[%06-junk]hex%
+Set-Cookie: cookie6=-junk
-+Set-Cookie: cookie7=%hex[%07-junk]hex%
+Set-Cookie: cookie7=-junk
-+Set-Cookie: cookie8=%hex[%08-junk]hex%
+Set-Cookie: cookie8=-junk
-+Set-Cookie: cookie9=%hex[junk-%09-]hex%
+Set-Cookie: cookie9=junk-	-
-+Set-Cookie: cookie11=%hex[%0b-junk]hex%
+Set-Cookie: cookie11=-junk
-+Set-Cookie: cookie12=%hex[%0c-junk]hex%
+Set-Cookie: cookie12=-junk
-+Set-Cookie: cookie14=%hex[%0e-junk]hex%
+Set-Cookie: cookie14=-junk
-+Set-Cookie: cookie15=%hex[%0f-junk]hex%
+Set-Cookie: cookie15=-junk
-+Set-Cookie: cookie16=%hex[%10-junk]hex%
+Set-Cookie: cookie16=-junk
-+Set-Cookie: cookie17=%hex[%11-junk]hex%
+Set-Cookie: cookie17=-junk
-+Set-Cookie: cookie18=%hex[%12-junk]hex%
+Set-Cookie: cookie18=-junk
-+Set-Cookie: cookie19=%hex[%13-junk]hex%
+Set-Cookie: cookie19=-junk
-+Set-Cookie: cookie20=%hex[%14-junk]hex%
+Set-Cookie: cookie20=-junk
-+Set-Cookie: cookie21=%hex[%15-junk]hex%
+Set-Cookie: cookie21=-junk
-+Set-Cookie: cookie22=%hex[%16-junk]hex%
+Set-Cookie: cookie22=-junk
-+Set-Cookie: cookie23=%hex[%17-junk]hex%
+Set-Cookie: cookie23=-junk
-+Set-Cookie: cookie24=%hex[%18-junk]hex%
+Set-Cookie: cookie24=-junk
-+Set-Cookie: cookie25=%hex[%19-junk]hex%
+Set-Cookie: cookie25=-junk
-+Set-Cookie: cookie26=%hex[%1a-junk]hex%
+Set-Cookie: cookie26=-junk
-+Set-Cookie: cookie27=%hex[%1b-junk]hex%
+Set-Cookie: cookie27=-junk
-+Set-Cookie: cookie28=%hex[%1c-junk]hex%
+Set-Cookie: cookie28=-junk
-+Set-Cookie: cookie29=%hex[%1d-junk]hex%
+Set-Cookie: cookie29=-junk
-+Set-Cookie: cookie30=%hex[%1e-junk]hex%
+Set-Cookie: cookie30=-junk
-+Set-Cookie: cookie31=%hex[%1f-junk]hex%
+Set-Cookie: cookie31=-junk
-+Set-Cookie: cookie31=%hex[%7f-junk]hex%
+Set-Cookie: cookie31=-junk
 </file>
 <precheck>
-@@ -60,7 +90,7 @@ GET /we/want/%TESTNUMBER HTTP/1.1
+@@ -62,7 +92,7 @@ perl -e 'if ("%HOSTIP" !~ /\.0\.0\.1$/) {print "Test only works for HOSTIPs endi
 GET /we/want/8 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 User-Agent: curl/%VERSION
 Accept: */*
 -Cookie: name with space=is weird but; trailingspace=removed; cookie=perhaps; cookie=yes; foobar=name; blexp=yesyes
 +Cookie: name with space=is weird but; trailingspace=removed; cookie=perhaps; cookie=yes; foobar=name; blexp=yesyes; cookie9=junk-	-
--- a/SOURCES/0044-curl-7.61.1-retry-http11.patch
+++ b/SOURCES/0044-curl-7.61.1-retry-http11.patch
@ -0,0 +1,112 @@
 From 78b62ef1206621e8f4f1628ad4eb0a7be877c96f Mon Sep 17 00:00:00 2001
 From: Johannes Schindelin <johannes.schindelin@gmx.de>
 Date: Fri, 7 Dec 2018 17:04:39 +0100
 Subject: [PATCH] Upon HTTP_1_1_REQUIRED, retry the request with HTTP/1.1
 This is a companion patch to cbea2fd2c (NTLM: force the connection to
 HTTP/1.1, 2018-12-06): with NTLM, we can switch to HTTP/1.1
 preemptively. However, with other (Negotiate) authentication it is not
 clear to this developer whether there is a way to make it work with
 HTTP/2, so let's try HTTP/2 first and fall back in case we encounter the
 error HTTP_1_1_REQUIRED.
 Note: we will still keep the NTLM workaround, as it avoids an extra
 round trip.
 Daniel Stenberg helped a lot with this patch, in particular by
 suggesting to introduce the Curl_h2_http_1_1_error() function.
 Closes #3349
 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
 Upstream-commit: d997aa0e963c5be5de100dccdc5208d39bd3d62b
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/http2.c |  8 ++++++++
 lib/http2.h |  4 ++++
 lib/multi.c | 20 ++++++++++++++++++++
 3 files changed, 32 insertions(+)
 diff --git a/lib/http2.c b/lib/http2.c
 index d769193..3071097 100644
 --- a/lib/http2.c
 +++ b/lib/http2.c
@@ -2300,6 +2300,14 @@ void Curl_http2_cleanup_dependencies(struct Curl_easy *data)
     Curl_http2_remove_child(data->set.stream_depends_on, data);
 }
 +/* Only call this function for a transfer that already got a HTTP/2
 +   CURLE_HTTP2_STREAM error! */
 +bool Curl_h2_http_1_1_error(struct connectdata *conn)
 +{
 +  struct http_conn *httpc = &conn->proto.httpc;
 +  return (httpc->error_code == NGHTTP2_HTTP_1_1_REQUIRED);
 +}
 +
 #else /* !USE_NGHTTP2 */
 /* Satisfy external references even if http2 is not compiled in. */
 diff --git a/lib/http2.h b/lib/http2.h
 index 21cd9b8..91e504c 100644
 --- a/lib/http2.h
 +++ b/lib/http2.h
@@ -59,6 +59,9 @@ CURLcode Curl_http2_add_child(struct Curl_easy *parent,
 void Curl_http2_remove_child(struct Curl_easy *parent,
                              struct Curl_easy *child);
 void Curl_http2_cleanup_dependencies(struct Curl_easy *data);
 +
 +/* returns true if the HTTP/2 stream error was HTTP_1_1_REQUIRED */
 +bool Curl_h2_http_1_1_error(struct connectdata *conn);
 #else /* USE_NGHTTP2 */
 #define Curl_http2_init(x) CURLE_UNSUPPORTED_PROTOCOL
 #define Curl_http2_send_request(x) CURLE_UNSUPPORTED_PROTOCOL
@@ -74,6 +77,7 @@ void Curl_http2_cleanup_dependencies(struct Curl_easy *data);
 #define Curl_http2_add_child(x, y, z)
 #define Curl_http2_remove_child(x, y)
 #define Curl_http2_cleanup_dependencies(x)
 +#define Curl_h2_http_1_1_error(x) 0
 #endif
 #endif /* HEADER_CURL_HTTP2_H */
 diff --git a/lib/multi.c b/lib/multi.c
 index 0f57fd5..d64ba94 100644
 --- a/lib/multi.c
 +++ b/lib/multi.c
@@ -46,6 +46,7 @@
 #include "vtls/vtls.h"
 #include "connect.h"
 #include "http_proxy.h"
 +#include "http2.h"
 /* The last 3 #include files should be in this order */
 #include "curl_printf.h"
 #include "curl_memory.h"
@@ -1943,6 +1944,25 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
           done = TRUE;
         }
       }
 +      else if((CURLE_HTTP2_STREAM == result) &&
 +                Curl_h2_http_1_1_error(data->easy_conn)) {
 +        CURLcode ret = Curl_retry_request(data->easy_conn, &newurl);
 +
 +        infof(data, "Forcing HTTP/1.1 for NTLM");
 +        data->set.httpversion = CURL_HTTP_VERSION_1_1;
 +
 +        if(!ret)
 +          retry = (newurl)?TRUE:FALSE;
 +        else
 +          result = ret;
 +
 +        if(retry) {
 +          /* if we are to retry, set the result to OK and consider the
 +             request as done */
 +          result = CURLE_OK;
 +          done = TRUE;
 +        }
 +      }
       if(result) {
         /*
 -- 
 2.37.3
--- a/SOURCES/0045-curl-7.61.1-CVE-2022-43552.patch
+++ b/SOURCES/0045-curl-7.61.1-CVE-2022-43552.patch
@ -20,16 +20,16 @@ diff --git a/lib/smb.c b/lib/smb.c
 index 039d680..f682c1f 100644
 --- a/lib/smb.c
 +++ b/lib/smb.c
-@@ -60,8 +60,6 @@ static CURLcode smb_connect(struct Curl_easy *data, bool *done);
+@@ -61,8 +61,6 @@ static CURLcode smb_connect(struct connectdata *conn, bool *done);
- static CURLcode smb_connection_state(struct Curl_easy *data, bool *done);
+ static CURLcode smb_connection_state(struct connectdata *conn, bool *done);
- static CURLcode smb_do(struct Curl_easy *data, bool *done);
+ static CURLcode smb_do(struct connectdata *conn, bool *done);
- static CURLcode smb_request_state(struct Curl_easy *data, bool *done);
+ static CURLcode smb_request_state(struct connectdata *conn, bool *done);
-static CURLcode smb_done(struct Curl_easy *data, CURLcode status,
+-static CURLcode smb_done(struct connectdata *conn, CURLcode status,
 -                         bool premature);
- static CURLcode smb_disconnect(struct Curl_easy *data,
+ static CURLcode smb_disconnect(struct connectdata *conn, bool dead);
-                                struct connectdata *conn, bool dead);
+ static int smb_getsock(struct connectdata *conn, curl_socket_t *socks,
- static int smb_getsock(struct Curl_easy *data, struct connectdata *conn,
+                        int numsocks);
-@@ -76,7 +74,7 @@ const struct Curl_handler Curl_handler_smb = {
+@@ -75,7 +73,7 @@ const struct Curl_handler Curl_handler_smb = {
   "SMB",                                /* scheme */
   smb_setup_connection,                 /* setup_connection */
   smb_do,                               /* do_it */
@ -38,7 +38,7 @@ index 039d680..f682c1f 100644
   ZERO_NULL,                            /* do_more */
   smb_connect,                          /* connect_it */
   smb_connection_state,                 /* connecting */
-@@ -103,7 +101,7 @@ const struct Curl_handler Curl_handler_smbs = {
+@@ -100,7 +98,7 @@ const struct Curl_handler Curl_handler_smbs = {
   "SMBS",                               /* scheme */
   smb_setup_connection,                 /* setup_connection */
   smb_do,                               /* do_it */
@ -47,31 +47,31 @@ index 039d680..f682c1f 100644
   ZERO_NULL,                            /* do_more */
   smb_connect,                          /* connect_it */
   smb_connection_state,                 /* connecting */
-@@ -941,14 +939,6 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
+@@ -915,14 +913,6 @@ static CURLcode smb_request_state(struct connectdata *conn, bool *done)
   return CURLE_OK;
 }
-static CURLcode smb_done(struct Curl_easy *data, CURLcode status,
+-static CURLcode smb_done(struct connectdata *conn, CURLcode status,
 -                         bool premature)
 -{
 -  (void) premature;
-  Curl_safefree(data->req.p.smb);
+-  Curl_safefree(conn->data->req.protop);
 -  return status;
 -}
 -
- static CURLcode smb_disconnect(struct Curl_easy *data,
+ static CURLcode smb_disconnect(struct connectdata *conn, bool dead)
                                struct connectdata *conn, bool dead)
 {
   struct smb_conn *smbc = &conn->proto.smbc;
 diff --git a/lib/telnet.c b/lib/telnet.c
 index 923c7f8..48cd0d7 100644
 --- a/lib/telnet.c
 +++ b/lib/telnet.c
-@@ -1248,9 +1248,6 @@ static CURLcode telnet_done(struct Curl_easy *data,
+@@ -1294,9 +1294,6 @@ static CURLcode telnet_done(struct connectdata *conn,
   curl_slist_free_all(tn->telnet_vars);
   tn->telnet_vars = NULL;
 -
-  Curl_safefree(data->req.p.telnet);
+-  Curl_safefree(conn->data->req.protop);
 -
   return CURLE_OK;
 }
--- a/SOURCES/0046-curl-7.61.1-h2-window-size.patch
+++ b/SOURCES/0046-curl-7.61.1-h2-window-size.patch
@ -0,0 +1,44 @@
 From 4bbd1947aeb26d5dbcddbb058652e0e64771b71d Mon Sep 17 00:00:00 2001
 From: Kamil Dudka <kdudka@redhat.com>
 Date: Mon, 6 Feb 2023 17:46:36 +0100
 Subject: [PATCH] h2: lower initial window size to 32 MiB
 Cherry-picked from upstream commit
 15f51474c837679c0b79825c23356ac681ffabde which was focused on paused
 transfers but required an update of nghttp2 to work properly.
 Bug: https://bugzilla.redhat.com/2166254
 ---
 lib/http2.c         | 2 +-
 tests/data/test1800 | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 diff --git a/lib/http2.c b/lib/http2.c
 index 3071097..1fd2233 100644
 --- a/lib/http2.c
 +++ b/lib/http2.c
@@ -63,7 +63,7 @@
 #define NGHTTP2_HAS_SET_LOCAL_WINDOW_SIZE 1
 #endif
 -#define HTTP2_HUGE_WINDOW_SIZE (1 << 30)
 +#define HTTP2_HUGE_WINDOW_SIZE (32 * 1024 * 1024) /* 32 MB */
 #ifdef DEBUG_HTTP2
 #define H2BUGF(x) x
 diff --git a/tests/data/test1800 b/tests/data/test1800
 index 0110184..c308c99 100644
 --- a/tests/data/test1800
 +++ b/tests/data/test1800
@@ -48,7 +48,7 @@ Host: %HOSTIP:%HTTPPORT
 Accept: */*
 Connection: Upgrade, HTTP2-Settings
 Upgrade: %H2CVER
 -HTTP2-Settings: AAMAAABkAARAAAAAAAIAAAAA
 +HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA
 </protocol>
 </verify>
 -- 
 2.39.1
--- a/SOURCES/0047-curl-7.61.1-CVE-2023-23916.patch
+++ b/SOURCES/0047-curl-7.61.1-CVE-2023-23916.patch
@ -0,0 +1,331 @@
 From 95f873ff983a1ae57415b3c16a881e74432cf8b8 Mon Sep 17 00:00:00 2001
 From: Fabian Keil <fk@fabiankeil.de>
 Date: Tue, 9 Feb 2021 14:04:32 +0100
 Subject: [PATCH 1/2] runtests.pl: support the nonewline attribute for the data
 part
 Closes #8239
 Upstream-commit: 736847611a40c01e7c290407e22e2f0f5f8efd6a
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/runtests.pl      |  7 +++++++
 tests/server/getpart.c | 11 ++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)
 diff --git a/tests/runtests.pl b/tests/runtests.pl
 index 40315aa..2e1500d 100755
 --- a/tests/runtests.pl
 +++ b/tests/runtests.pl
@@ -3817,6 +3817,13 @@ sub singletest {
     else {
         # check against the data section
         @reply = getpart("reply", "data");
 +        if(@reply) {
 +            my %hash = getpartattr("reply", "data");
 +            if($hash{'nonewline'}) {
 +                # cut off the final newline from the final line of the data
 +                chomp($reply[$#reply]);
 +            }
 +        }
         # get the mode attribute
         my $filemode=$replyattr{'mode'};
         if($filemode && ($filemode eq "text") && $has_textaware) {
 diff --git a/tests/server/getpart.c b/tests/server/getpart.c
 index 32b55bc..f8fe3f6 100644
 --- a/tests/server/getpart.c
 +++ b/tests/server/getpart.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
 - * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
 + * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -295,6 +295,7 @@ int getpart(char **outbuf, size_t *outlen,
   size_t outalloc = 256;
   int in_wanted_part = 0;
   int base64 = 0;
 +  int nonewline = 0;
   int error;
   enum {
@@ -360,6 +361,8 @@ int getpart(char **outbuf, size_t *outlen,
             if(error)
               return error;
           }
 +          if(nonewline)
 +            (*outlen)--;
           break;
         }
       }
@@ -377,6 +380,8 @@ int getpart(char **outbuf, size_t *outlen,
             if(error)
               return error;
           }
 +          if(nonewline)
 +            (*outlen)--;
           break;
         }
       }
@@ -451,6 +456,10 @@ int getpart(char **outbuf, size_t *outlen,
               /* bit rough test, but "mostly" functional, */
               /* treat wanted part data as base64 encoded */
               base64 = 1;
 +          if(strstr(patt, "nonewline=")) {
 +            show(("* setting nonewline\n"));
 +            nonewline = 1;
 +          }
         }
         continue;
       }
 -- 
 2.39.1
 From bc5fc958b017895728962c9d44c469418cbec1a0 Mon Sep 17 00:00:00 2001
 From: Patrick Monnerat <patrick@monnerat.net>
 Date: Mon, 13 Feb 2023 08:33:09 +0100
 Subject: [PATCH 2/2] content_encoding: do not reset stage counter for each
 header
 Test 418 verifies
 Closes #10492
 Upstream-commit: 119fb187192a9ea13dc90d9d20c215fc82799ab9
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/content_encoding.c  |   7 +-
 lib/urldata.h           |   1 +
 tests/data/Makefile.inc |   1 +
 tests/data/test387      |   2 +-
 tests/data/test418      | 152 ++++++++++++++++++++++++++++++++++++++++
 5 files changed, 158 insertions(+), 5 deletions(-)
 create mode 100644 tests/data/test418
 diff --git a/lib/content_encoding.c b/lib/content_encoding.c
 index bfc13e2..94344d6 100644
 --- a/lib/content_encoding.c
 +++ b/lib/content_encoding.c
@@ -944,7 +944,6 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
 {
   struct Curl_easy *data = conn->data;
   struct SingleRequest *k = &data->req;
 -  int counter = 0;
   do {
     const char *name;
@@ -979,9 +978,9 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
       if(!encoding)
         encoding = &error_encoding;  /* Defer error at stack use. */
 -      if(++counter >= MAX_ENCODE_STACK) {
 -        failf(data, "Reject response due to %u content encodings",
 -              counter);
 +      if(k->writer_stack_depth++ >= MAX_ENCODE_STACK) {
 +        failf(data, "Reject response due to more than %u content encodings",
 +              MAX_ENCODE_STACK);
         return CURLE_BAD_CONTENT_ENCODING;
       }
       /* Stack the unencoding stage. */
 diff --git a/lib/urldata.h b/lib/urldata.h
 index 5b4b34f..8c8c20b 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -539,6 +539,7 @@ struct SingleRequest {
   struct curltime start;         /* transfer started at this time */
   struct curltime now;           /* current time */
 +  unsigned char writer_stack_depth; /* Unencoding stack depth. */
   bool header;                  /* incoming data has HTTP header */
   enum {
     HEADER_NORMAL,              /* no bad header at all */
 diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
 index fb51cd6..86b6f85 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
@@ -66,6 +66,7 @@ test393 test394 test395 \
 \
 test400 test401 test402 test403 test404 test405 test406 test407 test408 \
 test409 \
 +test418 \
 \
 test500 test501 test502 test503 test504 test505 test506 test507 test508 \
 test509 test510 test511 test512 test513 test514 test515 test516 test517 \
 diff --git a/tests/data/test387 b/tests/data/test387
 index 015ec25..644fc7f 100644
 --- a/tests/data/test387
 +++ b/tests/data/test387
@@ -47,7 +47,7 @@ Accept: */*
 61
 </errorcode>
 <stderr mode="text">
 -curl: (61) Reject response due to 5 content encodings
 +curl: (61) Reject response due to more than 5 content encodings
 </stderr>
 </verify>
 </testcase>
 diff --git a/tests/data/test418 b/tests/data/test418
 new file mode 100644
 index 0000000..50e974e
 --- /dev/null
 +++ b/tests/data/test418
@@ -0,0 +1,152 @@
 +<testcase>
 +<info>
 +<keywords>
 +HTTP
 +gzip
 +</keywords>
 +</info>
 +
 +#
 +# Server-side
 +<reply>
 +<data nocheck="yes">
 +HTTP/1.1 200 OK
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +
 +-foo-
 +</data>
 +</reply>
 +
 +#
 +# Client-side
 +<client>
 +<server>
 +http
 +</server>
 + <name>
 +Response with multiple Transfer-Encoding headers
 + </name>
 + <command>
 +http://%HOSTIP:%HTTPPORT/%TESTNUMBER -sS
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<protocol>
 +GET /%TESTNUMBER HTTP/1.1
 +Host: %HOSTIP:%HTTPPORT
 +User-Agent: curl/7.61.1
 +Accept: */*
 +
 +</protocol>
 +
 +# CURLE_BAD_CONTENT_ENCODING is 61
 +<errorcode>
 +61
 +</errorcode>
 +<stderr mode="text">
 +curl: (61) Reject response due to more than 5 content encodings
 +</stderr>
 +</verify>
 +</testcase>
 -- 
 2.39.1
--- a/SOURCES/0048-curl-7.61.1-CVE-2023-27535.patch
+++ b/SOURCES/0048-curl-7.61.1-CVE-2023-27535.patch
@ -25,7 +25,7 @@ diff --git a/lib/strcase.c b/lib/strcase.c
 index f932485..c73907d 100644
 --- a/lib/strcase.c
 +++ b/lib/strcase.c
-@@ -261,6 +261,28 @@ bool Curl_safecmp(char *a, char *b)
+@@ -175,6 +175,28 @@ bool Curl_safecmp(char *a, char *b)
   return !a && !b;
 }
@ -58,8 +58,8 @@ diff --git a/lib/strcase.h b/lib/strcase.h
 index d245929..11a67a1 100644
 --- a/lib/strcase.h
 +++ b/lib/strcase.h
-@@ -49,5 +49,6 @@ void Curl_strntoupper(char *dest, const char *src, size_t n);
+@@ -48,5 +48,6 @@ char Curl_raw_toupper(char in);
- void Curl_strntolower(char *dest, const char *src, size_t n);
+ void Curl_strntoupper(char *dest, const char *src, size_t n);
 bool Curl_safecmp(char *a, char *b);
 +int Curl_timestrcmp(const char *first, const char *second);
@ -83,30 +83,30 @@ Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 lib/ftp.c     | 28 ++++++++++++++++++++++++++--
 lib/ftp.h     |  5 +++++
 lib/setopt.c  |  2 +-
- lib/url.c     | 12 ++++++++++++
+ lib/url.c     | 13 ++++++++++++-
 lib/urldata.h |  4 ++--
- 5 files changed, 46 insertions(+), 5 deletions(-)
+ 5 files changed, 46 insertions(+), 6 deletions(-)
 diff --git a/lib/ftp.c b/lib/ftp.c
 index 9442832..df15bc0 100644
 --- a/lib/ftp.c
 +++ b/lib/ftp.c
-@@ -4086,6 +4086,8 @@ static CURLcode ftp_disconnect(struct Curl_easy *data,
+@@ -4080,6 +4080,8 @@ static CURLcode ftp_disconnect(struct connectdata *conn, bool dead_connection)
   }
   freedirs(ftpc);
 +  Curl_safefree(ftpc->account);
 +  Curl_safefree(ftpc->alternative_to_user);
-   Curl_safefree(ftpc->prevpath);
+   free(ftpc->prevpath);
-   Curl_safefree(ftpc->server_os);
+   ftpc->prevpath = NULL;
-   Curl_pp_disconnect(pp);
+   free(ftpc->server_os);
-@@ -4346,11 +4348,31 @@ static CURLcode ftp_setup_connection(struct Curl_easy *data,
+@@ -4391,11 +4393,31 @@ static CURLcode ftp_setup_connection(struct connectdata *conn)
- {
+   struct Curl_easy *data = conn->data;
   char *type;
   struct FTP *ftp;
 +  struct ftp_conn *ftpc = &conn->proto.ftpc;
-  data->req.p.ftp = ftp = calloc(sizeof(struct FTP), 1);
+-  conn->data->req.protop = ftp = malloc(sizeof(struct FTP));
 +  ftp = calloc(sizeof(struct FTP), 1);
   if(NULL == ftp)
     return CURLE_OUT_OF_MEMORY;
@ -128,15 +128,15 @@ index 9442832..df15bc0 100644
 +      return CURLE_OUT_OF_MEMORY;
 +    }
 +  }
-+  data->req.p.ftp = ftp;
+  data->req.protop = ftp;
 +
-   ftp->path = &data->state.up.path[1]; /* don't include the initial slash */
+   data->state.path++;   /* don't include the initial slash */
   data->state.slash_removed = TRUE; /* we've skipped the slash */
@@ -4445,7 +4467,9 @@ static CURLcode ftp_setup_connection(struct connectdata *conn)
   if(isBadFtpString(ftp->passwd))
     return CURLE_URL_MALFORMAT;
   /* FTP URLs support an extension like ";type=<typecode>" that
@@ -4385,7 +4407,9 @@ static CURLcode ftp_setup_connection(struct Curl_easy *data,
   /* get some initial data into the ftp struct */
   ftp->transfer = PPTRANSFER_BODY;
   ftp->downloadsize = 0;
 -  conn->proto.ftpc.known_filesize = -1; /* unknown size for now */
 +  ftpc->known_filesize = -1; /* unknown size for now */
 +  ftpc->use_ssl = data->set.use_ssl;
@ -148,15 +148,15 @@ diff --git a/lib/ftp.h b/lib/ftp.h
 index 7f6f432..3f33e27 100644
 --- a/lib/ftp.h
 +++ b/lib/ftp.h
-@@ -115,6 +115,8 @@ struct FTP {
+@@ -117,6 +117,8 @@ struct FTP {
    struct */
 struct ftp_conn {
   struct pingpong pp;
 +  char *account;
 +  char *alternative_to_user;
   char *entrypath; /* the PWD reply when we logged on */
   char *file;    /* url-decoded file name (or path) */
   char **dirs;   /* realloc()ed array for path components */
   int dirdepth;  /* number of entries used in the 'dirs' array */
@@ -144,6 +146,9 @@ struct ftp_conn {
   ftpstate state; /* always use ftp.c:state() to change state! */
   ftpstate state_saved; /* transfer type saved to be reloaded after
@ -171,9 +171,9 @@ diff --git a/lib/setopt.c b/lib/setopt.c
 index 3339a67..6fc111d 100644
 --- a/lib/setopt.c
 +++ b/lib/setopt.c
-@@ -2264,7 +2264,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
+@@ -2039,7 +2039,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
     arg = va_arg(param, long);
-     if((arg < CURLUSESSL_NONE) || (arg >= CURLUSESSL_LAST))
+     if((arg < CURLUSESSL_NONE) || (arg > CURLUSESSL_ALL))
       return CURLE_BAD_FUNCTION_ARGUMENT;
 -    data->set.use_ssl = (curl_usessl)arg;
 +    data->set.use_ssl = (unsigned char)arg;
@ -184,12 +184,13 @@ diff --git a/lib/url.c b/lib/url.c
 index 61ba832..4e21838 100644
 --- a/lib/url.c
 +++ b/lib/url.c
-@@ -1329,6 +1329,18 @@ ConnectionExists(struct Curl_easy *data,
+@@ -1309,7 +1309,18 @@ ConnectionExists(struct Curl_easy *data,
         if(!ssh_config_matches(needle, check))
           continue;
       }
 -
 +#ifndef CURL_DISABLE_FTP
-+      else if(get_protocol_family(needle->handler) & PROTO_FAMILY_FTP) {
+      if(needle->handler->protocol & (CURLPROTO_FTP|CURLPROTO_FTPS)) {
 +        /* Also match ACCOUNT, ALTERNATIVE-TO-USER, USE_SSL and CCC options */
 +        if(Curl_timestrcmp(needle->proto.ftpc.account,
 +                           check->proto.ftpc.account) ||
@ -200,31 +201,31 @@ index 61ba832..4e21838 100644
 +          continue;
 +      }
 +#endif
- 
+       if(!needle->bits.httpproxy || (needle->handler->flags&PROTOPT_SSL) ||
-       if((needle->handler->flags&PROTOPT_SSL)
+          needle->bits.tunnel_proxy) {
- #ifndef CURL_DISABLE_PROXY
+         /* The requested connection does not use a HTTP proxy or it uses SSL or
 diff --git a/lib/urldata.h b/lib/urldata.h
 index 9d9ca92..4e2f5b9 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
-@@ -1749,8 +1749,6 @@ struct UserDefined {
+@@ -1498,6 +1498,8 @@ struct UserDefined {
-   void *ssh_keyfunc_userp;         /* custom pointer to callback */
+   curl_write_callback fwrite_header; /* function that stores headers */
-   enum CURL_NETRC_OPTION
+   curl_write_callback fwrite_rtp;    /* function that stores interleaved RTP */
-        use_netrc;        /* defined in include/curl.h */
+   curl_read_callback fread_func_set; /* function that reads the input */
 -  curl_usessl use_ssl;   /* if AUTH TLS is to be attempted etc, for FTP or
 -                            IMAP or POP3 or others! */
   long new_file_perms;    /* Permissions to use when creating remote files */
   long new_directory_perms; /* Permissions to use when creating remote dirs */
   long ssh_auth_types;   /* allowed SSH auth types */
@@ -1793,6 +1791,8 @@ struct UserDefined {
   CURLU *uh; /* URL handle for the current parsed URL */
   void *trailer_data; /* pointer to pass to trailer data callback */
   curl_trailer_callback trailer_callback; /* trailing data callback */
 +  unsigned char use_ssl;   /* if AUTH TLS is to be attempted etc, for FTP or
 +                              IMAP or POP3 or others! (type: curl_usessl)*/
-   BIT(is_fread_set); /* has read callback been set to non-NULL? */
+   int is_fread_set; /* boolean, has read callback been set to non-NULL? */
-   BIT(is_fwrite_set); /* has write callback been set to non-NULL? */
+   int is_fwrite_set; /* boolean, has write callback been set to non-NULL? */
-   BIT(free_referer); /* set TRUE if 'referer' points to a string we
+   curl_progress_callback fprogress; /* OLD and deprecated progress callback  */
@@ -1622,8 +1624,6 @@ struct UserDefined {
   bool ftp_use_eprt;     /* if EPRT is to be attempted or not */
   bool ftp_use_pret;     /* if PRET is to be used before PASV or not */
 -  curl_usessl use_ssl;   /* if AUTH TLS is to be attempted etc, for FTP or
 -                            IMAP or POP3 or others! */
   curl_ftpauth ftpsslauth; /* what AUTH XXX to be attempted */
   curl_ftpccc ftp_ccc;   /* FTP CCC options */
   bool no_signal;        /* do not use any signal/alarm handler */
 -- 
 2.39.2
--- a/SOURCES/0049-curl-7.61.1-CVE-2023-27536.patch
+++ b/SOURCES/0049-curl-7.61.1-CVE-2023-27536.patch
@ -0,0 +1,55 @@
 From 9d6dd7bc1dea42ae8e710aeae714e2a2c290de61 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Fri, 10 Mar 2023 09:22:43 +0100
 Subject: [PATCH] url: only reuse connections with same GSS delegation
 Reported-by: Harry Sintonen
 Closes #10731
 Upstream-commit: cb49e67303dbafbab1cebf4086e3ec15b7d56ee5
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/url.c     | 6 ++++++
 lib/urldata.h | 2 ++
 2 files changed, 8 insertions(+)
 diff --git a/lib/url.c b/lib/url.c
 index 3b11b7e..cbbc7f3 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -1305,6 +1305,11 @@ ConnectionExists(struct Curl_easy *data,
         }
       }
 +      /* GSS delegation differences do not actually affect every connection
 +         and auth method, but this check takes precaution before efficiency */
 +      if(needle->gssapi_delegation != check->gssapi_delegation)
 +        continue;
 +
       if(needle->handler->protocol & (CURLPROTO_SCP|CURLPROTO_SFTP)) {
         if(!ssh_config_matches(needle, check))
           continue;
@@ -1949,6 +1954,7 @@ static struct connectdata *allocate_conn(struct Curl_easy *data)
      it may live on without (this specific) Curl_easy */
   conn->fclosesocket = data->set.fclosesocket;
   conn->closesocket_client = data->set.closesocket_client;
 +  conn->gssapi_delegation = data->set.gssapi_delegation;
   return conn;
   error:
 diff --git a/lib/urldata.h b/lib/urldata.h
 index ce90304..9e16f26 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -856,6 +856,8 @@ struct connectdata {
   int httpversion;        /* the HTTP version*10 reported by the server */
   int rtspversion;        /* the RTSP version*10 reported by the server */
 +  unsigned char gssapi_delegation; /* inherited from set.gssapi_delegation */
 +
   struct curltime now;     /* "current" time */
   struct curltime created; /* creation time */
   curl_socket_t sock[2]; /* two sockets, the second is used for the data
 -- 
 2.39.2
--- a/SOURCES/0050-curl-7.61.1-sftp-upload-flags.patch
+++ b/SOURCES/0050-curl-7.61.1-sftp-upload-flags.patch
@ -0,0 +1,34 @@
 From cc52b2d89397ff26b01d791cd1c605cba741aaa4 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Felix=20H=C3=A4dicke?= <felixhaedicke@web.de>
 Date: Wed, 24 Jul 2019 11:47:51 +0200
 Subject: [PATCH] ssh-libssh: do not specify O_APPEND when not in append mode
 Specifying O_APPEND in conjunction with O_TRUNC and O_CREAT does not
 make much sense. And this combination of flags is not accepted by all
 SFTP servers (at least not Apache SSHD).
 Fixes #4147
 Closes #4148
 Upstream-commit: 62617495102c60124db8a909f592f063e38a89aa
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/ssh-libssh.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/lib/ssh-libssh.c b/lib/ssh-libssh.c
 index 4110be2..2414173 100644
 --- a/lib/ssh-libssh.c
 +++ b/lib/ssh-libssh.c
@@ -1112,7 +1112,7 @@ static CURLcode myssh_statemach_act(struct connectdata *conn, bool *block)
         flags = O_WRONLY|O_APPEND;
       else
         /* Clear file before writing (normal behaviour) */
 -        flags = O_WRONLY|O_APPEND|O_CREAT|O_TRUNC;
 +        flags = O_WRONLY|O_CREAT|O_TRUNC;
       if(sshc->sftp_file)
         sftp_close(sshc->sftp_file);
 -- 
 2.39.2
--- a/SOURCES/0051-curl-7.61.1-CVE-2023-28321.patch
+++ b/SOURCES/0051-curl-7.61.1-CVE-2023-28321.patch
@ -143,7 +143,7 @@ index 84f962abebee3..f31b2c2a3f330 100644
 </keywords>
 </info>
-@@ -14,9 +13,9 @@ none
+@@ -15,10 +14,10 @@ none
 <features>
 unittest
 </features>
@ -153,9 +153,10 @@ index 84f962abebee3..f31b2c2a3f330 100644
 +<name>
 +Curl_cert_hostcheck unit tests
 +</name>
 <tool>
 unit1397
 </tool>
 </client>
 </testcase>
 diff --git a/tests/unit/unit1397.c b/tests/unit/unit1397.c
 index 2f3d3aa4d09e1..3ae75618d5d10 100644
 --- a/tests/unit/unit1397.c
@ -179,7 +180,7 @@ index 2f3d3aa4d09e1..3ae75618d5d10 100644
 -UNITTEST_START
 -
 /* only these backends define the tested functions */
-#if defined(USE_OPENSSL) || defined(USE_GSKIT)
+-#if defined(USE_OPENSSL) || defined(USE_AXTLS) || defined(USE_GSKIT)
 -
 -  /* here you start doing things and checking that the results are good */
 +#if defined(USE_OPENSSL) || defined(USE_GSKIT) || defined(USE_SCHANNEL)
--- a/SOURCES/0052-curl-7.61.1-certs.patch
+++ b/SOURCES/0052-curl-7.61.1-certs.patch
--- a/SOURCES/0053-curl-7.61.1-password-when-keyboard-interactive-fails.patch
+++ b/SOURCES/0053-curl-7.61.1-password-when-keyboard-interactive-fails.patch
@ -0,0 +1,169 @@
 From be17dc9d31e805c03372b690dde67838b3bfc12d Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Wed, 24 May 2023 16:34:11 +0200
 Subject: [PATCH] libssh: when keyboard-interactive auth fails, try password
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The state machine had a mistake in that it would not carry on to that
 next step.
 This also adds a verbose output what methods that are available from the
 server and renames the macros that change to the next auth methods to
 try.
 Reported-by: 左潇峰
 Fixes #11196
 Closes #11197
 ---
 lib/ssh-libssh.c | 43 +++++++++++++++++++++++++++----------------
 1 file changed, 27 insertions(+), 16 deletions(-)
 diff --git a/lib/ssh-libssh.c b/lib/ssh-libssh.c
 index 7ebe61321419f..1cecb649cb623 100644
 --- a/lib/ssh-libssh.c
 +++ b/lib/ssh-libssh.c
@@ -442,7 +442,7 @@ static int myssh_is_known(struct Curl_easy *data)
   break; \
 }
 -#define MOVE_TO_LAST_AUTH \
 +#define MOVE_TO_PASSWD_AUTH \
   if(sshc->auth_methods & SSH_AUTH_METHOD_PASSWORD) { \
     rc = SSH_OK; \
     state(conn, SSH_AUTH_PASS_INIT); \
@@ -452,25 +452,25 @@ static int myssh_is_known(struct Curl_easy *data)
     MOVE_TO_ERROR_STATE(CURLE_LOGIN_DENIED); \
   }
 -#define MOVE_TO_TERTIARY_AUTH \
 +#define MOVE_TO_KEY_AUTH \
   if(sshc->auth_methods & SSH_AUTH_METHOD_INTERACTIVE) { \
     rc = SSH_OK; \
     state(conn, SSH_AUTH_KEY_INIT); \
     break; \
   } \
   else { \
 -    MOVE_TO_LAST_AUTH; \
 +    MOVE_TO_PASSWD_AUTH; \
   }
 -#define MOVE_TO_SECONDARY_AUTH \
 +#define MOVE_TO_GSSAPI_AUTH \
   if(sshc->auth_methods & SSH_AUTH_METHOD_GSSAPI_MIC) { \
     rc = SSH_OK; \
     state(conn, SSH_AUTH_GSSAPI); \
     break; \
   } \
   else { \
 -    MOVE_TO_TERTIARY_AUTH; \
 +    MOVE_TO_KEY_AUTH; \
   }
 static
 int myssh_auth_interactive(struct connectdata *conn)
@@ -617,6 +617,16 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
         }
         sshc->auth_methods = ssh_userauth_list(sshc->ssh_session, NULL);
 +        if(sshc->auth_methods)
 +          infof(data, "SSH authentication methods available: %s%s%s%s",
 +                sshc->auth_methods & SSH_AUTH_METHOD_PUBLICKEY ?
 +                "public key, ": "",
 +                sshc->auth_methods & SSH_AUTH_METHOD_GSSAPI_MIC ?
 +                "GSSAPI, " : "",
 +                sshc->auth_methods & SSH_AUTH_METHOD_INTERACTIVE ?
 +                "keyboard-interactive, " : "",
 +                sshc->auth_methods & SSH_AUTH_METHOD_PASSWORD ?
 +                "password": "");
         if(sshc->auth_methods & SSH_AUTH_METHOD_PUBLICKEY) {
           state(conn, SSH_AUTH_PKEY_INIT);
           infof(data, "Authentication using SSH public key file\n");
@@ -761,8 +761,8 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
       }
     case SSH_AUTH_PKEY_INIT:
       if(!(data->set.ssh_auth_types & CURLSSH_AUTH_PUBLICKEY)) {
 -        MOVE_TO_SECONDARY_AUTH;
 +        MOVE_TO_GSSAPI_AUTH;
       }
       /* Two choices, (1) private key was given on CMD,
        * (2) use the "default" keys. */
@@ -776,7 +776,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
           }
           if(rc != SSH_OK) {
 -            MOVE_TO_SECONDARY_AUTH;
 +            MOVE_TO_GSSAPI_AUTH;
           }
         }
@@ -826,7 +836,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
           break;
         }
 -        MOVE_TO_SECONDARY_AUTH;
 +        MOVE_TO_GSSAPI_AUTH;
       }
       break;
     case SSH_AUTH_PKEY:
@@ -828,13 +828,13 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
       }
       else {
         infof(data, "Failed public key authentication (rc: %d)\n", rc);
 -        MOVE_TO_SECONDARY_AUTH;
 +        MOVE_TO_GSSAPI_AUTH;
       }
       break;
     case SSH_AUTH_GSSAPI:
       if(!(data->set.ssh_auth_types & CURLSSH_AUTH_GSSAPI)) {
 -        MOVE_TO_TERTIARY_AUTH;
 +        MOVE_TO_KEY_AUTH;
       }
       rc = ssh_userauth_gssapi(sshc->ssh_session);
@@ -851,7 +851,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
         break;
       }
 -      MOVE_TO_TERTIARY_AUTH;
 +      MOVE_TO_KEY_AUTH;
       break;
     case SSH_AUTH_KEY_INIT:
@@ -736,13 +736,12 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
         state(conn, SSH_AUTH_KEY);
       }
       else {
 -        MOVE_TO_LAST_AUTH;
 +        MOVE_TO_PASSWD_AUTH;
       }
       break;
     case SSH_AUTH_KEY:
 -
 -      /* Authentication failed. Continue with keyboard-interactive now. */
 +      /* keyboard-interactive authentication */
       rc = myssh_auth_interactive(conn);
       if(rc == SSH_AGAIN) {
         break;
@@ -759,13 +759,15 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
       if(rc == SSH_OK) {
         sshc->authed = TRUE;
         infof(data, "completed keyboard interactive authentication\n");
 +        state(conn, SSH_AUTH_DONE);
 +      }
 +      else {
 +        MOVE_TO_PASSWD_AUTH;
       }
 -      state(conn, SSH_AUTH_DONE);
       break;
     case SSH_AUTH_PASS_INIT:
       if(!(data->set.ssh_auth_types & CURLSSH_AUTH_PASSWORD)) {
 -        /* Host key authentication is intentionally not implemented */
         MOVE_TO_ERROR_STATE(CURLE_LOGIN_DENIED);
       }
       state(conn, SSH_AUTH_PASS);
--- a/SOURCES/0054-curl-7.61.1-64K-sftp.patch
+++ b/SOURCES/0054-curl-7.61.1-64K-sftp.patch
@ -0,0 +1,31 @@
 From 35eb2614d86316ba9f5a6806ce64f56680fa1e97 Mon Sep 17 00:00:00 2001
 From: Jakub Jelen <jjelen@redhat.com>
 Date: Tue, 5 Sep 2023 17:33:41 +0200
 Subject: [PATCH] libssh: cap SFTP packet size sent
 Due to libssh limitations
 Signed-off-by: Jakub Jelen <jjelen@redhat.com>
 Closes #11804
 ---
 lib/ssh-libssh.c | 6 ++++++
 1 file changed, 6 insertions(+)
 diff --git a/lib/ssh-libssh.c b/lib/ssh-libssh.c
 index dea0084575859..7c6a2e53f338f 100644
 --- a/lib/ssh-libssh.c
 +++ b/lib/ssh-libssh.c
@@ -2412,6 +2412,12 @@ static ssize_t sftp_send(struct Curl_easy *data, int sockindex,
   ssize_t nwrite;
   (void)sockindex;
 +  /* limit the writes to the maximum specified in Section 3 of
 +   * https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-02
 +   */
 +  if(len > 32768)
 +    len = 32768;
 +
   nwrite = sftp_write(conn->proto.sshc.sftp_file, mem, len);
   myssh_block2waitfor(conn, FALSE);
--- a/SOURCES/0055-curl-7.61.1-CVE-2023-28322.patch
+++ b/SOURCES/0055-curl-7.61.1-CVE-2023-28322.patch
@ -19,10 +19,9 @@ internally and externally.
 lib/tftp.c         | 8 ++++----
 lib/transfer.c     | 4 ++--
 lib/urldata.h      | 2 +-
- lib/vssh/libssh.c  | 6 +++---
+ lib/ssh-libssh.c   | 6 +++---
- lib/vssh/libssh2.c | 6 +++---
+ lib/ssh.c          | 6 +++---
- lib/vssh/wolfssh.c | 2 +-
+ 14 files changed, 36 insertions(+), 38 deletions(-)
 15 files changed, 36 insertions(+), 38 deletions(-)
 diff --git a/lib/curl_rtmp.c b/lib/curl_rtmp.c
 index 2679a2cdc1afe..406fb42ac0f44 100644
@ -32,8 +31,8 @@ index 2679a2cdc1afe..406fb42ac0f44 100644
   /* We have to know if it's a write before we send the
    * connect request packet
    */
-  if(data->set.upload)
+-  if(conn->data->set.upload)
-+  if(data->state.upload)
+  if(conn->data->state.upload)
     r->Link.protocol |= RTMP_FEATURE_WRITE;
   /* For plain streams, use the buffer toggle trick to keep data flowing */
@ -41,10 +40,10 @@ index 2679a2cdc1afe..406fb42ac0f44 100644
   if(!RTMP_ConnectStream(r, 0))
     return CURLE_FAILED_INIT;
-  if(data->set.upload) {
+-  if(conn->data->set.upload) {
-+  if(data->state.upload) {
+  if(conn->data->state.upload) {
-     Curl_pgrsSetUploadSize(data, data->state.infilesize);
+     Curl_pgrsSetUploadSize(conn->data, conn->data->state.infilesize);
-     Curl_setup_transfer(data, -1, -1, FALSE, FIRSTSOCKET);
+     Curl_setup_transfer(conn, -1, -1, FALSE, NULL, FIRSTSOCKET, NULL);
   }
 diff --git a/lib/file.c b/lib/file.c
 index 51c5d07ce40ab..c751e8861a99b 100644
@ -56,8 +55,8 @@ index 51c5d07ce40ab..c751e8861a99b 100644
   file->fd = fd;
 -  if(!data->set.upload && (fd == -1)) {
 +  if(!data->state.upload && (fd == -1)) {
-     failf(data, "Couldn't open file %s", data->state.up.path);
+     failf(data, "Couldn't open file %s", data->state.path);
-     file_done(data, CURLE_FILE_COULDNT_READ_FILE, FALSE);
+     file_done(conn, CURLE_FILE_COULDNT_READ_FILE, FALSE);
     return CURLE_FILE_COULDNT_READ_FILE;
@@ -422,7 +422,7 @@ static CURLcode file_do(struct Curl_easy *data, bool *done)
@ -65,22 +64,22 @@ index 51c5d07ce40ab..c751e8861a99b 100644
 -  if(data->set.upload)
 +  if(data->state.upload)
-     return file_upload(data);
+     return file_upload(conn);
-   file = data->req.p.file;
+   file = conn->data->req.protop;
 diff --git a/lib/ftp.c b/lib/ftp.c
 index f50d7baf622f8..4ff68cc454cbc 100644
 --- a/lib/ftp.c
 +++ b/lib/ftp.c
@@ -1381,7 +1381,7 @@ static CURLcode ftp_state_prepare_transfer(struct Curl_easy *data)
                                data->set.str[STRING_CUSTOMREQUEST]?
                 data->set.str[STRING_CUSTOMREQUEST]:
-                                (data->state.list_only?"NLST":"LIST"));
+                 (data->set.ftp_list_only?"NLST":"LIST"));
-      else if(data->set.upload)
+       }
-+      else if(data->state.upload)
+-      else if(data->set.upload) {
-         result = Curl_pp_sendf(data, &ftpc->pp, "PRET STOR %s",
+      else if(data->state.upload) {
-                                conn->proto.ftpc.file);
+         PPSENDF(&conn->proto.ftpc.pp, "PRET STOR %s", conn->proto.ftpc.file);
-       else
+       }
       else {
@@ -3368,7 +3368,7 @@ static CURLcode ftp_done(struct Curl_easy *data, CURLcode status,
     /* the response code from the transfer showed an error already so no
        use checking further */
@ -88,7 +87,7 @@ index f50d7baf622f8..4ff68cc454cbc 100644
 -  else if(data->set.upload) {
 +  else if(data->state.upload) {
     if((-1 != data->state.infilesize) &&
-        (data->state.infilesize != data->req.writebytecount) &&
+        (data->state.infilesize != *ftp->bytecountp) &&
        !data->set.crlf &&
@@ -3640,7 +3640,7 @@ static CURLcode ftp_do_more(struct Curl_easy *data, int *completep)
                            connected back to us */
@ -96,68 +95,66 @@ index f50d7baf622f8..4ff68cc454cbc 100644
     }
 -    else if(data->set.upload) {
 +    else if(data->state.upload) {
-       result = ftp_nb_type(data, conn, data->state.prefer_ascii,
+       result = ftp_nb_type(conn, data->set.prefer_ascii, FTP_STOR_TYPE);
                            FTP_STOR_TYPE);
       if(result)
         return result;
@@ -4217,7 +4217,7 @@ CURLcode ftp_parse_url_path(struct Curl_easy *data)
-     ftpc->file = NULL; /* instead of point to a zero byte,
+     ftpc->file = NULL; /* instead of point to a zero byte, we make it a NULL
-                             we make it a NULL pointer */
+                           pointer */
-  if(data->set.upload && !ftpc->file && (ftp->transfer == PPTRANSFER_BODY)) {
+-  if(data->set.upload && !ftpc->file && (ftp->transfer == FTPTRANSFER_BODY)) {
-+  if(data->state.upload && !ftpc->file && (ftp->transfer == PPTRANSFER_BODY)) {
+  if(data->state.upload && !ftpc->file && (ftp->transfer == FTPTRANSFER_BODY)) {
     /* We need a file name when uploading. Return error! */
     failf(data, "Uploading to a URL without a file name!");
-     free(rawPath);
+     return CURLE_URL_MALFORMAT;
 diff --git a/lib/http.c b/lib/http.c
 index 80e43f6f361e8..bffdd3468536d 100644
 --- a/lib/http.c
 +++ b/lib/http.c
@@ -2112,7 +2112,7 @@ void Curl_http_method(struct Curl_easy *data, struct connectdata *conn,
-   Curl_HttpReq httpreq = data->state.httpreq;
+   http->writebytecount = http->readbytecount = 0;
-   const char *request;
+ 
-   if((conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_FTP)) &&
+   if((conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_FTP)) &&
-     data->set.upload)
+-     data->set.upload) {
-+     data->state.upload)
+     data->state.upload) {
-     httpreq = HTTPREQ_PUT;
+     httpreq = HTTPREQ_PUT;
   }
   /* Now set the 'request' pointer to the proper request string */
@@ -2423,7 +2423,7 @@ CURLcode Curl_http_body(struct Curl_easy *data, struct connectdata *conn,
     if((conn->handler->protocol & PROTO_FAMILY_HTTP) &&
        (((httpreq == HTTPREQ_POST_MIME || httpreq == HTTPREQ_POST_FORM) &&
        http->postsize < 0) ||
-        ((data->set.upload || httpreq == HTTPREQ_POST) &&
+-       (data->set.upload && data->state.infilesize == -1))) {
-+        ((data->state.upload || httpreq == HTTPREQ_POST) &&
+       (data->state.upload && data->state.infilesize == -1))) {
          data->state.infilesize == -1))) {
       if(conn->bits.authneg)
         /* don't enable chunked during auth neg */
         ;
 diff --git a/lib/imap.c b/lib/imap.c
 index c2f675d4b2618..1952e66a1efcd 100644
 --- a/lib/imap.c
 +++ b/lib/imap.c
-@@ -1511,11 +1511,11 @@ static CURLcode imap_done(struct Curl_easy *data, CURLcode status,
+@@ -1511,10 +1511,10 @@ static CURLcode imap_done(struct Curl_easy *data, CURLcode status,
     result = status;         /* use the already set error code */
   }
   else if(!data->set.connect_only && !imap->custom &&
-          (imap->uid || imap->mindex || data->set.upload ||
+-          (imap->uid || data->set.upload ||
-+          (imap->uid || imap->mindex || data->state.upload ||
+          (imap->uid || data->state.upload ||
           data->set.mimepost.kind != MIMEKIND_NONE)) {
     /* Handle responses after FETCH or APPEND transfer has finished */
 -    if(!data->set.upload && data->set.mimepost.kind == MIMEKIND_NONE)
 +    if(!data->state.upload && data->set.mimepost.kind == MIMEKIND_NONE)
-       state(data, IMAP_FETCH_FINAL);
+       state(conn, IMAP_FETCH_FINAL);
     else {
       /* End the APPEND command first by sending an empty line */
@@ -1581,7 +1581,7 @@ static CURLcode imap_perform(struct Curl_easy *data, bool *connected,
     selected = TRUE;
   /* Start the first command in the DO phase */
-  if(data->set.upload || data->set.mimepost.kind != MIMEKIND_NONE)
+-  if(conn->data->set.upload || data->set.mimepost.kind != MIMEKIND_NONE)
-+  if(data->state.upload || data->set.mimepost.kind != MIMEKIND_NONE)
+  if(conn->data->state.upload || data->set.mimepost.kind != MIMEKIND_NONE)
     /* APPEND can be executed directly */
-     result = imap_perform_append(data);
+     result = imap_perform_append(conn);
   else if(imap->custom && (selected || !imap->mailbox))
 diff --git a/lib/rtsp.c b/lib/rtsp.c
 index ea99d720ec4eb..ccd7264b00e74 100644
 --- a/lib/rtsp.c
 +++ b/lib/rtsp.c
@ -168,11 +165,11 @@ index ea99d720ec4eb..ccd7264b00e74 100644
 -    if(data->set.upload) {
 +    if(data->state.upload) {
       putsize = data->state.infilesize;
-       data->state.httpreq = HTTPREQ_PUT;
+       data->set.httpreq = HTTPREQ_PUT;
@@ -512,7 +512,7 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
-         result =
+       if(!Curl_checkheaders(conn, "Content-Length")) {
-           Curl_dyn_addf(&req_buffer,
+         result = Curl_add_bufferf(req_buffer,
             "Content-Length: %" CURL_FORMAT_CURL_OFF_T"\r\n",
 -            (data->set.upload ? putsize : postsize));
 +            (data->state.upload ? putsize : postsize));
@ -192,20 +189,12 @@ index 38f5711e44191..0c3b9634d1192 100644
 +    arg = va_arg(param, long);
 +    if(arg) {
       /* If this is HTTP, PUT is what's needed to "upload" */
-       data->set.method = HTTPREQ_PUT;
+       data->set.httpreq = HTTPREQ_PUT;
       data->set.opt_no_body = FALSE; /* this is implied */
@@ -628,7 +628,6 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
     }
     else
       data->set.method = HTTPREQ_GET;
 -    data->set.upload = FALSE;
     break;
   case CURLOPT_HTTPPOST:
@@ -888,7 +887,6 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
      */
     if(va_arg(param, long)) {
-       data->set.method = HTTPREQ_GET;
+       data->set.httpreq = HTTPREQ_GET;
 -      data->set.upload = FALSE; /* switch off upload */
       data->set.opt_no_body = FALSE; /* this is implied */
     }
@ -218,19 +207,19 @@ index a1e444ee6b97e..d6822213529bc 100644
   byte_count = strlen(req->path);
   msg.name_length = smb_swap16((unsigned short)byte_count);
   msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
-  if(data->set.upload) {
+-  if(conn->data->set.upload) {
-+  if(data->state.upload) {
+  if(conn->data->state.upload) {
     msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
     msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
   }
@@ -813,7 +813,7 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
     smb_m = (const struct smb_nt_create_response*) msg;
     req->fid = smb_swap16(smb_m->fid);
-     data->req.offset = 0;
+     conn->data->req.offset = 0;
-    if(data->set.upload) {
+-    if(conn->data->set.upload) {
-+    if(data->state.upload) {
+    if(conn->data->state.upload) {
-       data->req.size = data->state.infilesize;
+       conn->data->req.size = conn->data->state.infilesize;
-       Curl_pgrsSetUploadSize(data, data->req.size);
+       Curl_pgrsSetUploadSize(conn->data, conn->data->req.size);
       next_state = SMB_UPLOAD;
 diff --git a/lib/smtp.c b/lib/smtp.c
 index 7a030308d4689..c182cace742d7 100644
@ -252,7 +241,7 @@ index 7a030308d4689..c182cace742d7 100644
 -  if((data->set.upload || data->set.mimepost.kind) && data->set.mail_rcpt)
 +  if((data->state.upload || data->set.mimepost.kind) && data->set.mail_rcpt)
     /* MAIL transfer */
-     result = smtp_perform_mail(data);
+     result = smtp_perform_mail(conn);
   else
 diff --git a/lib/tftp.c b/lib/tftp.c
 index 164d3c723c5b9..8ed1b887b4d21 100644
@ -275,14 +264,14 @@ index 164d3c723c5b9..8ed1b887b4d21 100644
 +    if(data->state.upload) {
       /* If we are uploading, send an WRQ */
       setpacketevent(&state->spacket, TFTP_EVENT_WRQ);
-       state->data->req.upload_fromhere =
+       state->conn->data->req.upload_fromhere =
@@ -486,7 +486,7 @@ static CURLcode tftp_send_first(struct tftp_state_data *state,
     if(!data->set.tftp_no_options) {
       char buf[64];
       /* add tsize option */
 -      if(data->set.upload && (data->state.infilesize != -1))
 +      if(data->state.upload && (data->state.infilesize != -1))
-         msnprintf(buf, sizeof(buf), "%" CURL_FORMAT_CURL_OFF_T,
+         snprintf(buf, sizeof(buf), "%" CURL_FORMAT_CURL_OFF_T,
                  data->state.infilesize);
       else
@@ -540,7 +540,7 @@ static CURLcode tftp_send_first(struct tftp_state_data *state,
@ -302,18 +291,10 @@ index e9ab8fbf09510..cb69f3365855a 100644
 {
   data->state.fread_func = data->set.fread_func_set;
   data->state.in = data->set.in_set;
-+  data->state.upload = (data->state.httpreq == HTTPREQ_PUT);
+  data->state.upload = (data->set.httpreq == HTTPREQ_PUT);
 }
 /*
@@ -1801,7 +1801,6 @@ CURLcode Curl_follow(struct Curl_easy *data,
          data->state.httpreq != HTTPREQ_POST_MIME) ||
         !(data->set.keep_post & CURL_REDIR_POST_303))) {
       data->state.httpreq = HTTPREQ_GET;
 -      data->set.upload = false;
       infof(data, "Switch to %s\n",
             data->set.opt_no_body?"HEAD":"GET");
     }
@@ -1770,7 +1770,7 @@ CURLcode Curl_retry_request(struct Curl_easy *data, char **url)
   /* if we're talking upload, we can't do the checks below, unless the protocol
@ -328,32 +309,32 @@ index cca992a0295aa..a8580bdb66fe8 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -1494,6 +1494,7 @@ struct UrlState {
-   BIT(url_alloc);   /* URL string is malloc()'ed */
+ #ifdef CURLDEBUG
-   BIT(referer_alloc); /* referer string is malloc()ed */
+   bool conncache_lock;
-   BIT(wildcard_resolve); /* Set to true if any resolve change is a wildcard */
+ #endif
-+  BIT(upload);         /* upload request */
+  bool upload;         /* upload request */
 };
- /*
+ 
@@ -1838,7 +1839,6 @@ struct UserDefined {
-   BIT(http_auto_referer); /* set "correct" referer when following
+   bool http_set_referer; /* is a custom referer used */
-                              location: */
+   bool http_auto_referer; /* set "correct" referer when following location: */
-   BIT(opt_no_body);    /* as set with CURLOPT_NOBODY */
+   bool opt_no_body;      /* as set with CURLOPT_NOBODY */
-  BIT(upload);         /* upload request */
+-  bool upload;           /* upload request */
-   BIT(verbose);        /* output verbosity */
+   enum CURL_NETRC_OPTION
-   BIT(krb);            /* Kerberos connection requested */
+        use_netrc;        /* defined in include/curl.h */
-   BIT(reuse_forbid);   /* forbidden to be reused, close after use */
+   bool verbose;          /* output verbosity */
-diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c
+diff --git a/lib/ssh-libssh.c b/lib/ssh-libssh.c
 index b31f741ba9492..d60edaa303642 100644
--- a/lib/vssh/libssh.c
+--- a/lib/ssh-libssh.c
-+++ b/lib/vssh/libssh.c
+++ b/lib/ssh-libssh.c
@@ -1209,7 +1209,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
     }
     case SSH_SFTP_TRANS_INIT:
 -      if(data->set.upload)
 +      if(data->state.upload)
-         state(data, SSH_SFTP_UPLOAD_INIT);
+         state(conn, SSH_SFTP_UPLOAD_INIT);
       else {
         if(protop->path[strlen(protop->path)-1] == '/')
@@ -1802,7 +1802,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
@ -371,22 +352,22 @@ index b31f741ba9492..d60edaa303642 100644
     case SSH_SCP_DONE:
 -      if(data->set.upload)
 +      if(data->state.upload)
-         state(data, SSH_SCP_SEND_EOF);
+         state(conn, SSH_SCP_SEND_EOF);
       else
-         state(data, SSH_SCP_CHANNEL_FREE);
+         state(conn, SSH_SCP_CHANNEL_FREE);
-diff --git a/lib/vssh/libssh2.c b/lib/vssh/libssh2.c
+diff --git a/lib/ssh.c b/lib/ssh.c
 index f1154dc47a74e..f2e5352d1fd3a 100644
--- a/lib/vssh/libssh2.c
+--- a/lib/ssh.c
-+++ b/lib/vssh/libssh2.c
+++ b/lib/ssh.c
@@ -2019,7 +2019,7 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block)
     }
     case SSH_SFTP_TRANS_INIT:
 -      if(data->set.upload)
 +      if(data->state.upload)
-         state(data, SSH_SFTP_UPLOAD_INIT);
+         state(conn, SSH_SFTP_UPLOAD_INIT);
       else {
-         if(sshp->path[strlen(sshp->path)-1] == '/')
+         if(sftp_scp->path[strlen(sftp_scp->path)-1] == '/')
@@ -2691,7 +2691,7 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block)
         break;
       }
@ -402,19 +383,6 @@ index f1154dc47a74e..f2e5352d1fd3a 100644
     case SSH_SCP_DONE:
 -      if(data->set.upload)
 +      if(data->state.upload)
-         state(data, SSH_SCP_SEND_EOF);
+         state(conn, SSH_SCP_SEND_EOF);
       else
-         state(data, SSH_SCP_CHANNEL_FREE);
+         state(conn, SSH_SCP_CHANNEL_FREE);
 diff --git a/lib/vssh/wolfssh.c b/lib/vssh/wolfssh.c
 index 17d59ecd23bc8..2ca91b7363b1d 100644
 --- a/lib/vssh/wolfssh.c
 +++ b/lib/vssh/wolfssh.c
@@ -557,7 +557,7 @@ static CURLcode wssh_statemach_act(struct Curl_easy *data, bool *block)
       }
       break;
     case SSH_SFTP_TRANS_INIT:
 -      if(data->set.upload)
 +      if(data->state.upload)
         state(data, SSH_SFTP_UPLOAD_INIT);
       else {
         if(sftp_scp->path[strlen(sftp_scp->path)-1] == '/')
--- a/SOURCES/0056-curl-7.61.1-CVE-2023-38546.patch
+++ b/SOURCES/0056-curl-7.61.1-CVE-2023-38546.patch
@ -0,0 +1,124 @@
 From 61275672b46d9abb3285740467b882e22ed75da8 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 14 Sep 2023 23:28:32 +0200
 Subject: [PATCH] cookie: remove unnecessary struct fields
 Plus: reduce the hash table size from 256 to 63. It seems unlikely to
 make much of a speed difference for most use cases but saves 1.5KB of
 data per instance.
 Closes #11862
 ---
 lib/cookie.c | 13 +------------
 lib/cookie.h | 13 ++++---------
 lib/easy.c   |  4 +---
 3 files changed, 6 insertions(+), 24 deletions(-)
 diff --git a/lib/cookie.c b/lib/cookie.c
 index 4345a84c6fd9d..e39c89a94a960 100644
 --- a/lib/cookie.c
 +++ b/lib/cookie.c
@@ -119,7 +119,6 @@ static void freecookie(struct Cookie *co)
   free(co->name);
   free(co->value);
   free(co->maxage);
 -  free(co->version);
   free(co);
 }
@@ -717,11 +716,7 @@ Curl_cookie_add(struct Curl_easy *data,
           }
         }
         else if(strcasecompare("version", name)) {
 -          strstore(&co->version, whatptr);
 -          if(!co->version) {
 -            badcookie = TRUE;
 -            break;
 -          }
 +          /* just ignore */
         }
         else if(strcasecompare("max-age", name)) {
           /* Defined in RFC2109:
@@ -1159,7 +1154,6 @@ Curl_cookie_add(struct Curl_easy *data,
         free(clist->path);
         free(clist->spath);
         free(clist->expirestr);
 -        free(clist->version);
         free(clist->maxage);
         *clist = *co;  /* then store all the new data */
@@ -1223,9 +1217,6 @@ struct CookieInfo *Curl_cookie_init(struct Curl_easy *data,
     c = calloc(1, sizeof(struct CookieInfo));
     if(!c)
       return NULL; /* failed to get memory */
 -    c->filename = strdup(file?file:"none"); /* copy the name just in case */
 -    if(!c->filename)
 -      goto fail; /* failed to get memory */
   }
   else {
     /* we got an already existing one, use that */
@@ -1378,7 +1369,6 @@ static struct Cookie *dup_cookie(struct Cookie *src)
     CLONE(name);
     CLONE(value);
     CLONE(maxage);
 -    CLONE(version);
     d->expires = src->expires;
     d->tailmatch = src->tailmatch;
     d->secure = src->secure;
@@ -1595,7 +1585,6 @@ void Curl_cookie_cleanup(struct CookieInfo *c)
 {
   if(c) {
     unsigned int i;
 -    free(c->filename);
     for(i = 0; i < COOKIE_HASH_SIZE; i++)
       Curl_cookie_freelist(c->cookies[i]);
     free(c); /* free the base struct as well */
 diff --git a/lib/cookie.h b/lib/cookie.h
 index b3c0063b2cfb2..41e9e7a6914e0 100644
 --- a/lib/cookie.h
 +++ b/lib/cookie.h
@@ -36,11 +36,7 @@ struct Cookie {
   curl_off_t expires;  /* expires = <this> */
   char *expirestr;   /* the plain text version */
   bool tailmatch;    /* whether we do tail-matching of the domain name */
 -
 -  /* RFC 2109 keywords. Version=1 means 2109-compliant cookie sending */
 -  char *version;     /* Version = <value> */
   char *maxage;      /* Max-Age = <value> */
 -
   bool secure;       /* whether the 'secure' keyword was used */
   bool livecookie;   /* updated from a server, not a stored file */
   bool httponly;     /* true if the httponly directive is present */
@@ -56,15 +52,14 @@ struct Cookie {
   int creationtime;  /* time when the cookie was written */
 };
 -#define COOKIE_HASH_SIZE 256
 +#define COOKIE_HASH_SIZE 63
 struct CookieInfo {
   /* linked list of cookies we know of */
   struct Cookie *cookies[COOKIE_HASH_SIZE];
 -  char *filename;  /* file we read from/write to */
   bool running;    /* state info, for cookie adding information */
 -  long numcookies; /* number of cookies in the "jar" */
 +  int numcookies; /* number of cookies in the "jar" */
   bool newsession; /* new session, discard session cookies on load */
   int lastct;      /* last creation-time used in the jar */
 };
 diff --git a/lib/easy.c b/lib/easy.c
 index 16bbd35251d40..03195481f9780 100644
 --- a/lib/easy.c
 +++ b/lib/easy.c
@@ -925,9 +925,7 @@ struct Curl_easy *curl_easy_duphandle(struct Curl_easy *data)
   if(data->cookies) {
     /* If cookies are enabled in the parent handle, we enable them
        in the clone as well! */
 -    outcurl->cookies = Curl_cookie_init(data,
 -                                        data->cookies->filename,
 -                                        outcurl->cookies,
 +    outcurl->cookies = Curl_cookie_init(data, NULL, outcurl->cookies,
                                         data->set.cookiesession);
     if(!outcurl->cookies)
       goto fail;
--- a/SOURCES/0057-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch
+++ b/SOURCES/0057-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch
@ -0,0 +1,193 @@
 diff -up curl-7.61.1/lib/http2.c.25a25f45 curl-7.61.1/lib/http2.c
 --- curl-7.61.1/lib/http2.c.25a25f45	2023-08-07 14:03:42.043463284 +0200
 +++ curl-7.61.1/lib/http2.c	2023-08-07 14:10:24.769489855 +0200
@@ -1202,7 +1202,7 @@ CURLcode Curl_http2_request_upgrade(Curl
   binlen = nghttp2_pack_settings_payload(binsettings, H2_BINSETTINGS_LEN,
                                          httpc->local_settings,
                                          httpc->local_settings_num);
 -  if(!binlen) {
 +  if(binlen <= 0) {
     failf(conn->data, "nghttp2 unexpectedly failed on pack_settings_payload");
     Curl_add_buffer_free(req);
     return CURLE_FAILED_INIT;
@@ -1285,6 +1285,14 @@ static int h2_process_pending_input(stru
     return -1;
   }
 +  if(nghttp2_session_check_request_allowed(httpc->h2) == 0) {
 +    /* No more requests are allowed in the current session, so
 +       the connection may not be reused. This is set when a
 +       GOAWAY frame has been received or when the limit of stream
 +       identifiers has been reached. */
 +    connclose(conn, "http/2: No new requests allowed");
 +  }
 +
   if(should_close_session(httpc)) {
     H2BUGF(infof(data,
                  "h2_process_pending_input: nothing to do in this session\n"));
@@ -1297,7 +1305,6 @@ static int h2_process_pending_input(stru
     }
     return -1;
   }
 -
   return 0;
 }
@@ -1455,8 +1462,6 @@ static int h2_session_send(struct Curl_e
 static ssize_t http2_recv(struct connectdata *conn, int sockindex,
                           char *mem, size_t len, CURLcode *err)
 {
 -  CURLcode result = CURLE_OK;
 -  ssize_t rv;
   ssize_t nread;
   struct http_conn *httpc = &conn->proto.httpc;
   struct Curl_easy *data = conn->data;
@@ -1519,8 +1524,7 @@ static ssize_t http2_recv(struct connect
       /* We have paused nghttp2, but we have no pause data (see
          on_data_chunk_recv). */
       httpc->pause_stream_id = 0;
 -      if(h2_process_pending_input(conn, httpc, &result) != 0) {
 -        *err = result;
 +      if(h2_process_pending_input(conn, httpc, err) != 0) {
         return -1;
       }
     }
@@ -1549,8 +1553,7 @@ static ssize_t http2_recv(struct connect
          frames, then we have to call it again with 0-length data.
          Without this, on_stream_close callback will not be called,
          and stream could be hanged. */
 -      if(h2_process_pending_input(conn, httpc, &result) != 0) {
 -        *err = result;
 +      if(h2_process_pending_input(conn, httpc, err) != 0) {
         return -1;
       }
     }
@@ -1573,7 +1576,6 @@ static ssize_t http2_recv(struct connect
     return -1;
   }
   else {
 -    char *inbuf;
     /* remember where to store incoming data for this stream and how big the
        buffer is */
     stream->mem = mem;
@@ -1582,16 +1584,15 @@ static ssize_t http2_recv(struct connect
     if(httpc->inbuflen == 0) {
       nread = ((Curl_recv *)httpc->recv_underlying)(
 -          conn, FIRSTSOCKET, httpc->inbuf, H2_BUFSIZE, &result);
 +          conn, FIRSTSOCKET, httpc->inbuf, H2_BUFSIZE, err);
       if(nread == -1) {
 -        if(result != CURLE_AGAIN)
 +        if(*err != CURLE_AGAIN)
           failf(data, "Failed receiving HTTP2 data");
         else if(stream->closed)
           /* received when the stream was already closed! */
           return http2_handle_stream_close(conn, data, stream, err);
 -        *err = result;
         return -1;
       }
@@ -1604,47 +1605,17 @@ static ssize_t http2_recv(struct connect
       H2BUGF(infof(data, "nread=%zd\n", nread));
       httpc->inbuflen = nread;
 -      inbuf = httpc->inbuf;
 +
 +      DEBUGASSERT(httpc->nread_inbuf == 0);
     }
     else {
       nread = httpc->inbuflen - httpc->nread_inbuf;
 -      inbuf = httpc->inbuf + httpc->nread_inbuf;
 -
 +      (void)nread;  /* silence warning, used in debug */
       H2BUGF(infof(data, "Use data left in connection buffer, nread=%zd\n",
                    nread));
     }
 -    rv = nghttp2_session_mem_recv(httpc->h2, (const uint8_t *)inbuf, nread);
 -
 -    if(nghttp2_is_fatal((int)rv)) {
 -      failf(data, "nghttp2_session_mem_recv() returned %zd:%s\n",
 -            rv, nghttp2_strerror((int)rv));
 -      *err = CURLE_RECV_ERROR;
 -      return -1;
 -    }
 -    H2BUGF(infof(data, "nghttp2_session_mem_recv() returns %zd\n", rv));
 -    if(nread == rv) {
 -      H2BUGF(infof(data, "All data in connection buffer processed\n"));
 -      httpc->inbuflen = 0;
 -      httpc->nread_inbuf = 0;
 -    }
 -    else {
 -      httpc->nread_inbuf += rv;
 -      H2BUGF(infof(data, "%zu bytes left in connection buffer\n",
 -                   httpc->inbuflen - httpc->nread_inbuf));
 -    }
 -    /* Always send pending frames in nghttp2 session, because
 -       nghttp2_session_mem_recv() may queue new frame */
 -    rv = h2_session_send(data, httpc->h2);
 -    if(rv != 0) {
 -      *err = CURLE_SEND_ERROR;
 -      return -1;
 -    }
 -
 -    if(should_close_session(httpc)) {
 -      H2BUGF(infof(data, "http2_recv: nothing to do in this session\n"));
 -      *err = CURLE_HTTP2;
 +    if(h2_process_pending_input(conn, httpc, err) != 0)
       return -1;
 -    }
   }
   if(stream->memlen) {
     ssize_t retlen = stream->memlen;
@@ -2108,7 +2079,6 @@ CURLcode Curl_http2_switched(struct conn
   CURLcode result;
   struct http_conn *httpc = &conn->proto.httpc;
   int rv;
 -  ssize_t nproc;
   struct Curl_easy *data = conn->data;
   struct HTTP *stream = conn->data->req.protop;
@@ -2186,39 +2156,10 @@ CURLcode Curl_http2_switched(struct conn
     memcpy(httpc->inbuf, mem, nread);
   httpc->inbuflen = nread;
 -  nproc = nghttp2_session_mem_recv(httpc->h2, (const uint8_t *)httpc->inbuf,
 -                                   httpc->inbuflen);
 +  DEBUGASSERT(httpc->nread_inbuf == 0);
 -  if(nghttp2_is_fatal((int)nproc)) {
 -    failf(data, "nghttp2_session_mem_recv() failed: %s(%d)",
 -          nghttp2_strerror((int)nproc), (int)nproc);
 +  if(-1 == h2_process_pending_input(conn, httpc, &result))
     return CURLE_HTTP2;
 -  }
 -
 -  H2BUGF(infof(data, "nghttp2_session_mem_recv() returns %zd\n", nproc));
 -
 -  if((ssize_t)nread == nproc) {
 -    httpc->inbuflen = 0;
 -    httpc->nread_inbuf = 0;
 -  }
 -  else {
 -    httpc->nread_inbuf += nproc;
 -  }
 -
 -  /* Try to send some frames since we may read SETTINGS already. */
 -  rv = h2_session_send(data, httpc->h2);
 -
 -  if(rv != 0) {
 -    failf(data, "nghttp2_session_send() failed: %s(%d)",
 -          nghttp2_strerror(rv), rv);
 -    return CURLE_HTTP2;
 -  }
 -
 -  if(should_close_session(httpc)) {
 -    H2BUGF(infof(data,
 -                 "nghttp2_session_send(): nothing to do in this session\n"));
 -    return CURLE_HTTP2;
 -  }
   return CURLE_OK;
 }
--- a/SOURCES/0058-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch
+++ b/SOURCES/0058-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch
@ -0,0 +1,15 @@
 diff -up curl-7.61.1/lib/http2.c.c1b6a384 curl-7.61.1/lib/http2.c
 --- curl-7.61.1/lib/http2.c.c1b6a384	2023-08-07 13:59:18.482137005 +0200
 +++ curl-7.61.1/lib/http2.c	2023-08-07 14:03:42.043463284 +0200
@@ -1467,6 +1467,11 @@ static ssize_t http2_recv(struct connect
   if(should_close_session(httpc)) {
     H2BUGF(infof(data,
                  "http2_recv: nothing to do in this session\n"));
 +    if(conn->bits.close) {
 +      /* already marked for closure, return OK and we're done */
 +      *err = CURLE_OK;
 +      return 0;
 +    }
     *err = CURLE_HTTP2;
     return -1;
   }
--- a/SOURCES/0059-curl-7.61.1-CVE-2023-46218.patch
+++ b/SOURCES/0059-curl-7.61.1-CVE-2023-46218.patch
@ -0,0 +1,48 @@
 From 2b0994c29a721c91c572cff7808c572a24d251eb Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 23 Nov 2023 08:15:47 +0100
 Subject: [PATCH] cookie: lowercase the domain names before PSL checks
 Reported-by: Harry Sintonen
 Closes #12387
 ---
 lib/cookie.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)
 diff --git a/lib/cookie.c b/lib/cookie.c
 index 568cf537ad1b1f..9095cea3e97f22 100644
 --- a/lib/cookie.c
 +++ b/lib/cookie.c
@@ -1027,15 +1027,23 @@ Curl_cookie_add(struct Curl_easy *data,
 #ifdef USE_LIBPSL
   /* Check if the domain is a Public Suffix and if yes, ignore the cookie. */
   if(domain && co->domain && !isip(co->domain)) {
 -    const psl_ctx_t *psl = Curl_psl_use(data);
 -    int acceptable;
 -
 -    if(psl) {
 -      acceptable = psl_is_cookie_domain_acceptable(psl, domain, co->domain);
 -      Curl_psl_release(data);
 +    bool acceptable = FALSE;
 +    char lcase[256];
 +    char lcookie[256];
 +    size_t dlen = strlen(domain);
 +    size_t clen = strlen(co->domain);
 +    if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) {
 +      const psl_ctx_t *psl = Curl_psl_use(data);
 +      if(psl) {
 +        /* the PSL check requires lowercase domain name and pattern */
 +        Curl_strntolower(lcase, domain, dlen + 1);
 +        Curl_strntolower(lcookie, co->domain, clen + 1);
 +        acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie);
 +        Curl_psl_release(data);
 +      }
 +      else
 +        acceptable = !bad_domain(domain);
     }
 -    else
 -      acceptable = !bad_domain(domain);
     if(!acceptable) {
       infof(data, "cookie '%s' dropped, domain '%s' must not "
--- a/SOURCES/0060-curl-7.61.1-lowercase-headernames.patch
+++ b/SOURCES/0060-curl-7.61.1-lowercase-headernames.patch
@ -0,0 +1,136 @@
 From 0023fce38d3bd6ee0e9b6ff8708fee1195057846 Mon Sep 17 00:00:00 2001
 From: Barry Pollard <barry_pollard@hotmail.com>
 Date: Sun, 22 Sep 2019 21:17:12 +0100
 Subject: [PATCH] http: lowercase headernames for HTTP/2 and HTTP/3
 Closes #4401
 Fixes #4400
 ---
 lib/strcase.c      | 84 ++++++++++++++++++++++++++++++++++++++++++++++
 lib/strcase.h      |  2 ++
 5 files changed, 95 insertions(+), 3 deletions(-)
 diff --git a/lib/strcase.c b/lib/strcase.c
 index 24bcca932..098cec7a8 100644
 --- a/lib/strcase.c
 +++ b/lib/strcase.c
@@ -93,6 +93,75 @@ char Curl_raw_toupper(char in)
   return in;
 }
 +
 +/* Portable, consistent tolower (remember EBCDIC). Do not use tolower() because
 +   its behavior is altered by the current locale. */
 +char Curl_raw_tolower(char in)
 +{
 +#if !defined(CURL_DOES_CONVERSIONS)
 +  if(in >= 'A' && in <= 'Z')
 +    return (char)('a' + in - 'A');
 +#else
 +  switch(in) {
 +  case 'A':
 +    return 'a';
 +  case 'B':
 +    return 'b';
 +  case 'C':
 +    return 'c';
 +  case 'D':
 +    return 'd';
 +  case 'E':
 +    return 'e';
 +  case 'F':
 +    return 'f';
 +  case 'G':
 +    return 'g';
 +  case 'H':
 +    return 'h';
 +  case 'I':
 +    return 'i';
 +  case 'J':
 +    return 'j';
 +  case 'K':
 +    return 'k';
 +  case 'L':
 +    return 'l';
 +  case 'M':
 +    return 'm';
 +  case 'N':
 +    return 'n';
 +  case 'O':
 +    return 'o';
 +  case 'P':
 +    return 'p';
 +  case 'Q':
 +    return 'q';
 +  case 'R':
 +    return 'r';
 +  case 'S':
 +    return 's';
 +  case 'T':
 +    return 't';
 +  case 'U':
 +    return 'u';
 +  case 'V':
 +    return 'v';
 +  case 'W':
 +    return 'w';
 +  case 'X':
 +    return 'X';
 +  case 'Y':
 +    return 'y';
 +  case 'Z':
 +    return 'z';
 +  }
 +#endif
 +
 +  return in;
 +}
 +
 +
 /*
  * Curl_strcasecompare() is for doing "raw" case insensitive strings. This is
  * meant to be locale independent and only compare strings we know are safe
@@ -234,6 +303,21 @@ void Curl_strntoupper(char *dest, const char *src, size_t n)
   } while(*src++ && --n);
 }
 +/* Copy a lower case version of the string from src to dest.  The
 + * strings may overlap.  No more than n characters of the string are copied
 + * (including any NUL) and the destination string will NOT be
 + * NUL-terminated if that limit is reached.
 + */
 +void Curl_strntolower(char *dest, const char *src, size_t n)
 +{
 +  if(n < 1)
 +    return;
 +
 +  do {
 +    *dest++ = Curl_raw_tolower(*src);
 +  } while(*src++ && --n);
 +}
 +
 /* Compare case-sensitive NUL-terminated strings, taking care of possible
  * null pointers. Return true if arguments match.
  */
 diff --git a/lib/strcase.h b/lib/strcase.h
 index 6fee3840e..2f07a74c9 100644
 --- a/lib/strcase.h
 +++ b/lib/strcase.h
@@ -40,12 +40,14 @@ int Curl_safe_strcasecompare(const char *first, const char *second);
 int Curl_strncasecompare(const char *first, const char *second, size_t max);
 char Curl_raw_toupper(char in);
 +char Curl_raw_tolower(char in);
 /* checkprefix() is a shorter version of the above, used when the first
    argument is zero-byte terminated */
 #define checkprefix(a,b)    curl_strnequal(a,b,strlen(a))
 void Curl_strntoupper(char *dest, const char *src, size_t n);
 +void Curl_strntolower(char *dest, const char *src, size_t n);
 bool Curl_safecmp(char *a, char *b);
 int Curl_timestrcmp(const char *first, const char *second);
 -- 
 2.43.0
--- a/SOURCES/0061-curl-7.61.1-CVE-2024-2398.patch
+++ b/SOURCES/0061-curl-7.61.1-CVE-2024-2398.patch
@ -0,0 +1,80 @@
 From deca8039991886a559b67bcd6701db800a5cf764 Mon Sep 17 00:00:00 2001
 From: Stefan Eissing <stefan@eissing.org>
 Date: Wed, 6 Mar 2024 09:36:08 +0100
 Subject: [PATCH] http2: push headers better cleanup
 - provide common cleanup method for push headers
 Closes #13054
 ---
 lib/http2.c | 34 +++++++++++++++-------------------
 1 file changed, 15 insertions(+), 19 deletions(-)
 diff --git a/lib/http2.c b/lib/http2.c
 index c63ecd38371ab4..96868728a53a1f 100644
 --- a/lib/http2.c
 +++ b/lib/http2.c
@@ -271,6 +271,15 @@ static CURLcode http2_data_setup(struct Curl_cfilter *cf,
   return http2_perform_getsock(conn, sock, numsocks);
 }
 +static void free_push_headers(struct HTTP *http)
 +{
 +  size_t i;
 +  for(i = 0; i<http->push_headers_used; i++)
 +    free(http->push_headers[i]);
 +  Curl_safefree(http->push_headers);
 +  http->push_headers_used = 0;
 +}
 +
 /*
  * http2_stream_free() free HTTP2 stream related data
  */
@@ -306,11 +315,7 @@ static void http2_data_done(struct Curl_cfilter *cf,
     http->header_recvbuf = NULL; /* clear the pointer */
     Curl_add_buffer_free(http->trailer_recvbuf);
     http->trailer_recvbuf = NULL; /* clear the pointer */
 -    for(; http->push_headers_used > 0; --http->push_headers_used) {
 -      free(http->push_headers[http->push_headers_used - 1]);
 -    }
 -    free(http->push_headers);
 -    http->push_headers = NULL;
 +    free_push_headers(http);
   }
 }
@@ -860,7 +861,6 @@ static int push_promise(struct Curl_cfilter *cf,
     struct curl_pushheaders heads;
     CURLMcode rc;
     struct http_conn *httpc;
 -    size_t i;
     /* clone the parent */
     struct Curl_easy *newhandle = duphandle(data);
     if(!newhandle) {
@@ -904,11 +904,7 @@ static int push_promise(struct Curl_cfilter *cf,
     Curl_set_in_callback(data, false);
     /* free the headers again */
 -    for(i = 0; i<stream->push_headers_used; i++)
 -      free(stream->push_headers[i]);
 -    free(stream->push_headers);
 -    stream->push_headers = NULL;
 -    stream->push_headers_used = 0;
 +    free_push_headers(stream);
     if(rv) {
       /* denied, kill off the new handle again */
@@ -1426,10 +1422,10 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
             stream->push_headers_alloc) {
       char **headp;
       stream->push_headers_alloc *= 2;
 -      headp = Curl_saferealloc(stream->push_headers,
 -                               stream->push_headers_alloc * sizeof(char *));
 +      headp = realloc(stream->push_headers,
 +                      stream->push_headers_alloc * sizeof(char *));
       if(!headp) {
 -        stream->push_headers = NULL;
 +        free_push_headers(stream);
         return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
       }
       stream->push_headers = headp;
--- a/SOURCES/0101-curl-7.32.0-multilib.patch
+++ b/SOURCES/0101-curl-7.32.0-multilib.patch
@ -4,10 +4,10 @@ Date: Fri, 12 Apr 2013 12:04:05 +0200
 Subject: [PATCH] prevent multilib conflicts on the curl-config script
 ---
- curl-config.in     | 23 +++++------------------
+ curl-config.in     |   21 +++------------------
 docs/curl-config.1 |    4 +++-
 libcurl.pc.in      |    1 +
- 3 files changed, 9 insertions(+), 19 deletions(-)
+ 3 files changed, 7 insertions(+), 19 deletions(-)
 diff --git a/curl-config.in b/curl-config.in
 index 150004d..95d0759 100644
@ -22,7 +22,7 @@ index 150004d..95d0759 100644
         ;;
     --prefix)
-@@ -155,32 +155,19 @@ while test $# -gt 0; do
+@@ -143,32 +143,17 @@ while test $# -gt 0; do
         ;;
     --libs)
@ -31,7 +31,7 @@ index 150004d..95d0759 100644
 -        else
 -           CURLLIBDIR=""
 -        fi
-        if test "X@ENABLE_SHARED@" = "Xno"; then
+-        if test "X@REQUIRE_LIB_DEPS@" = "Xyes"; then
 -          echo ${CURLLIBDIR}-lcurl @LIBCURL_LIBS@
 -        else
 -          echo ${CURLLIBDIR}-lcurl
@ -49,8 +49,6 @@ index 150004d..95d0759 100644
 -          echo "curl was built with static libraries disabled" >&2
 -          exit 1
 -        fi
 +        echo "curl was built with static libraries disabled" >&2
 +        exit 1
         ;;
     --configure)
@ -85,7 +83,7 @@ index 2ba9c39..f8f8b00 100644
 +configure_options=@CONFIGURE_OPTIONS@
 Name: libcurl
- URL: https://curl.se/
+ URL: https://curl.haxx.se/
 -- 
-2.26.2
+2.5.0
--- a/SOURCES/0102-curl-7.36.0-debug.patch
+++ b/SOURCES/0102-curl-7.36.0-debug.patch
@ -1,21 +1,21 @@
-From 3602ee9dcc74683f91fe4f9ca228aa17a6474403 Mon Sep 17 00:00:00 2001
+From 6710648c2b270c9ce68a7d9f1bba1222c7be8b58 Mon Sep 17 00:00:00 2001
 From: Kamil Dudka <kdudka@redhat.com>
 Date: Wed, 31 Oct 2012 11:38:30 +0100
-Subject: [PATCH] prevent configure script from discarding -g in CFLAGS
+Subject: [PATCH] prevent configure script from discarding -g in CFLAGS (#496778)
 (#496778)
 ---
- m4/curl-compilers.m4 | 26 ++++++--------------------
+ configure            |   13 +++----------
- 1 file changed, 6 insertions(+), 20 deletions(-)
+ m4/curl-compilers.m4 |   13 +++----------
 2 files changed, 6 insertions(+), 20 deletions(-)
-diff --git a/m4/curl-compilers.m4 b/m4/curl-compilers.m4
+diff --git a/configure b/configure
-index c64db4bc6..d115a4aed 100644
+index 8f079a3..53b4774 100755
--- a/m4/curl-compilers.m4
+--- a/configure
-+++ b/m4/curl-compilers.m4
+++ b/configure
-@@ -106,18 +106,11 @@ AC_DEFUN([CURL_CHECK_COMPILER_CLANG], [
+@@ -16414,18 +16414,11 @@ $as_echo "yes" >&6; }
-     clangvhi=`echo $clangver | cut -d . -f1`
+     gccvhi=`echo $gccver | cut -d . -f1`
-     clangvlo=`echo $clangver | cut -d . -f2`
+     gccvlo=`echo $gccver | cut -d . -f2`
-     compiler_num=`(expr $clangvhi "*" 100 + $clangvlo) 2>/dev/null`
+     compiler_num=`(expr $gccvhi "*" 100 + $gccvlo) 2>/dev/null`
 -    flags_dbg_all="-g -g0 -g1 -g2 -g3"
 -    flags_dbg_all="$flags_dbg_all -ggdb"
 -    flags_dbg_all="$flags_dbg_all -gstabs"
@ -27,14 +27,18 @@ index c64db4bc6..d115a4aed 100644
 +    flags_dbg_all=""
     flags_dbg_yes="-g"
     flags_dbg_off=""
-    flags_opt_all="-O -O0 -O1 -O2 -Os -O3 -O4"
+-    flags_opt_all="-O -O0 -O1 -O2 -O3 -Os -Og -Ofast"
-    flags_opt_yes="-Os"
+-    flags_opt_yes="-O2"
 +    flags_opt_all=""
 +    flags_opt_yes=""
     flags_opt_off="-O0"
-   else
+ 
-     AC_MSG_RESULT([no])
+     OLDCPPFLAGS=$CPPFLAGS
-@@ -175,18 +168,11 @@ AC_DEFUN([CURL_CHECK_COMPILER_GNU_C], [
+diff --git a/m4/curl-compilers.m4 b/m4/curl-compilers.m4
 index 0cbba7a..9175b5b 100644
 --- a/m4/curl-compilers.m4
 +++ b/m4/curl-compilers.m4
@@ -157,18 +157,11 @@ AC_DEFUN([CURL_CHECK_COMPILER_GNU_C], [
     gccvhi=`echo $gccver | cut -d . -f1`
     gccvlo=`echo $gccver | cut -d . -f2`
     compiler_num=`(expr $gccvhi "*" 100 + $gccvlo) 2>/dev/null`
--- a/SOURCES/0103-curl-7.59.0-python3.patch
+++ b/SOURCES/0103-curl-7.59.0-python3.patch
@ -0,0 +1,140 @@
 From bdba7b54224814055185513de1e7ff6619031553 Mon Sep 17 00:00:00 2001
 From: Kamil Dudka <kdudka@redhat.com>
 Date: Thu, 15 Mar 2018 13:21:40 +0100
 Subject: [PATCH 1/2] tests/http_pipe.py: migrate to Python 3
 ---
 tests/http_pipe.py | 4 ++--
 tests/runtests.pl  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
 diff --git a/tests/http_pipe.py b/tests/http_pipe.py
 index bc32173..75ac165 100755
 --- a/tests/http_pipe.py
 +++ b/tests/http_pipe.py
@@ -383,13 +383,13 @@ class PipelineRequestHandler(socketserver.BaseRequestHandler):
           self.request.setblocking(True)
           if not new_data:
             return
 -          new_requests = self._request_parser.ParseAdditionalData(new_data)
 +          new_requests = self._request_parser.ParseAdditionalData(new_data.decode('utf8'))
           self._response_builder.QueueRequests(
               new_requests, self._request_parser.were_all_requests_http_1_1)
           self._num_queued += len(new_requests)
           self._last_queued_time = time.time()
         elif fileno in wlist:
 -          num_bytes_sent = self.request.send(self._send_buffer[0:4096])
 +          num_bytes_sent = self.request.send(self._send_buffer[0:4096].encode('utf8'))
           self._send_buffer = self._send_buffer[num_bytes_sent:]
           time.sleep(0.05)
 diff --git a/tests/runtests.pl b/tests/runtests.pl
 index d6aa5ca..4d395ef 100755
 --- a/tests/runtests.pl
 +++ b/tests/runtests.pl
@@ -1439,7 +1439,7 @@ sub runhttpserver {
     elsif($alt eq "pipe") {
         # basically the same, but another ID
         $idnum = 3;
 -        $exe = "python $srcdir/http_pipe.py";
 +        $exe = "python3 $srcdir/http_pipe.py";
         $verbose_flag .= "1 ";
     }
     elsif($alt eq "unix") {
 -- 
 2.14.3
 From 3c4c7340e455b7256c0786759422f34ec3e2d440 Mon Sep 17 00:00:00 2001
 From: Kamil Dudka <kdudka@redhat.com>
 Date: Thu, 15 Mar 2018 14:49:56 +0100
 Subject: [PATCH 2/2] tests/{negtelnet,smb}server.py: migrate to Python 3
 Unfortunately, smbserver.py does not work with Python 3 because
 there is no 'impacket' module available for Python 3:
 https://github.com/CoreSecurity/impacket/issues/61
 ---
 tests/negtelnetserver.py | 12 ++++++------
 tests/smbserver.py       |  4 ++--
 2 files changed, 8 insertions(+), 8 deletions(-)
 diff --git a/tests/negtelnetserver.py b/tests/negtelnetserver.py
 index 8cfd409..72ee771 100755
 --- a/tests/negtelnetserver.py
 +++ b/tests/negtelnetserver.py
@@ -23,7 +23,7 @@ IDENT = "NTEL"
 # The strings that indicate the test framework is checking our aliveness
 VERIFIED_REQ = b"verifiedserver"
 -VERIFIED_RSP = b"WE ROOLZ: {pid}"
 +VERIFIED_RSP = "WE ROOLZ: {pid}"
 def telnetserver(options):
@@ -34,7 +34,7 @@ def telnetserver(options):
     if options.pidfile:
         pid = os.getpid()
         with open(options.pidfile, "w") as f:
 -            f.write(b"{0}".format(pid))
 +            f.write("{0}".format(pid))
     local_bind = (HOST, options.port)
     log.info("Listening on %s", local_bind)
@@ -73,11 +73,11 @@ class NegotiatingTelnetHandler(socketserver.BaseRequestHandler):
                 response_data = VERIFIED_RSP.format(pid=os.getpid())
             else:
                 log.debug("Received normal request - echoing back")
 -                response_data = data.strip()
 +                response_data = data.decode('utf8').strip()
             if response_data:
                 log.debug("Sending %r", response_data)
 -                self.request.sendall(response_data)
 +                self.request.sendall(response_data.encode('utf8'))
         except IOError:
             log.exception("IOError hit during request")
@@ -132,7 +132,7 @@ class Negotiator(object):
         return buffer
     def byte_to_int(self, byte):
 -        return struct.unpack(b'B', byte)[0]
 +        return int(byte)
     def no_neg(self, byte, byte_int, buffer):
         # Not negotiating anything thus far. Check to see if we
@@ -197,7 +197,7 @@ class Negotiator(object):
         self.tcp.sendall(packed_message)
     def pack(self, arr):
 -        return struct.pack(b'{0}B'.format(len(arr)), *arr)
 +        return struct.pack('{0}B'.format(len(arr)), *arr)
     def send_iac(self, arr):
         message = [NegTokens.IAC]
 diff --git a/tests/smbserver.py b/tests/smbserver.py
 index 195ae39..b09cd44 100755
 --- a/tests/smbserver.py
 +++ b/tests/smbserver.py
@@ -24,7 +24,7 @@
 from __future__ import (absolute_import, division, print_function)
 # unicode_literals)
 import argparse
 -import ConfigParser
 +import configparser
 import os
 import sys
 import logging
@@ -58,7 +58,7 @@ def smbserver(options):
             f.write("{0}".format(pid))
     # Here we write a mini config for the server
 -    smb_config = ConfigParser.ConfigParser()
 +    smb_config = configparser.ConfigParser()
     smb_config.add_section("global")
     smb_config.set("global", "server_name", "SERVICE")
     smb_config.set("global", "server_os", "UNIX")
 -- 
 2.14.3
--- a/SOURCES/0104-curl-7.19.7-localhost6.patch
+++ b/SOURCES/0104-curl-7.19.7-localhost6.patch
@ -0,0 +1,51 @@
 diff --git a/tests/data/test1083 b/tests/data/test1083
 index e441278..b0958b6 100644
 --- a/tests/data/test1083
 +++ b/tests/data/test1083
@@ -33,13 +33,13 @@ ipv6
 http-ipv6
 </server>
  <name>
 -HTTP-IPv6 GET with ip6-localhost --interface
 +HTTP-IPv6 GET with localhost6 --interface
  </name>
  <command>
 --g "http://%HOST6IP:%HTTP6PORT/1083" --interface ip6-localhost
 +-g "http://%HOST6IP:%HTTP6PORT/1083" --interface localhost6
 </command>
 <precheck>
 -perl -e "if ('%CLIENT6IP' ne '[::1]') {print 'Test requires default test server host address';} else {exec './server/resolve --ipv6 ip6-localhost'; print 'Cannot run precheck resolve';}"
 +perl -e "if ('%CLIENT6IP' ne '[::1]') {print 'Test requires default test server host address';} else {exec './server/resolve --ipv6 localhost6'; print 'Cannot run precheck resolve';}"
 </precheck>
 </client>
 diff --git a/tests/data/test241 b/tests/data/test241
 index 46eae1f..4e1632c 100644
 --- a/tests/data/test241
 +++ b/tests/data/test241
@@ -30,13 +30,13 @@ ipv6
 http-ipv6
 </server>
  <name>
 -HTTP-IPv6 GET (using ip6-localhost)
 +HTTP-IPv6 GET (using localhost6)
  </name>
  <command>
 --g "http://ip6-localhost:%HTTP6PORT/241"
 +-g "http://localhost6:%HTTP6PORT/241"
 </command>
 <precheck>
 -./server/resolve --ipv6 ip6-localhost
 +./server/resolve --ipv6 localhost6
 </precheck>
 </client>
@@ -48,7 +48,7 @@ HTTP-IPv6 GET (using ip6-localhost)
 </strip>
 <protocol>
 GET /241 HTTP/1.1
 -Host: ip6-localhost:%HTTP6PORT
 +Host: localhost6:%HTTP6PORT
 Accept: */*
 </protocol>
--- a/SOURCES/0105-curl-7.61.1-test-ports.patch
+++ b/SOURCES/0105-curl-7.61.1-test-ports.patch
@ -0,0 +1,71 @@
 From e6507a9abbfd4ac93ea3053c8f3385a2405f19d8 Mon Sep 17 00:00:00 2001
 From: Kamil Dudka <kdudka@redhat.com>
 Date: Fri, 29 Jan 2021 11:34:49 +0100
 Subject: [PATCH] tests: do not hard-wire ports of test servers
 ---
 tests/data/test1448 | 4 ++--
 tests/data/test651  | 2 +-
 tests/data/test653  | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)
 diff --git a/tests/data/test1448 b/tests/data/test1448
 index e04f47b..5022ef9 100644
 --- a/tests/data/test1448
 +++ b/tests/data/test1448
@@ -17,7 +17,7 @@ HTTP/1.1 302 OK swsbounce
 Date: Thu, 09 Nov 2010 14:49:00 GMT
 Content-Length: 9
 Content-Type: text/plain
 -Location: http://åäö.se:8990/14480001
 +Location: http://åäö.se:%HTTPPORT/14480001
 redirect
 </data>
@@ -52,7 +52,7 @@ Redirect following to UTF-8 IDN host name
  </name>
  <command>
 -http://åäö.se:%HTTPPORT/1448 --resolve xn--4cab6c.se:%HTTPPORT:%HOSTIP -L --connect-to %HOSTIP:8990:%HOSTIP:%HTTPPORT
 +http://åäö.se:%HTTPPORT/1448 --resolve xn--4cab6c.se:%HTTPPORT:%HOSTIP -L --connect-to %HOSTIP:%HTTPPORT:%HOSTIP:%HTTPPORT
 </command>
 </client>
 diff --git a/tests/data/test651 b/tests/data/test651
 index b00ca5d..8d47c9f 100644
 --- a/tests/data/test651
 +++ b/tests/data/test651
@@ -57,7 +57,7 @@ s/boundary=------------------------[a-z0-9]*/boundary=--------------------------
 # (5*12) == 60 bytes less
 <protocol>
 POST /651 HTTP/1.1
 -Host: 127.0.0.1:8990
 +Host: 127.0.0.1:%HTTPPORT
 Accept: */*
 Content-Length: 17139
 Content-Type: multipart/form-data; boundary=----------------------------
 diff --git a/tests/data/test653 b/tests/data/test653
 index d620b57..492d551 100644
 --- a/tests/data/test653
 +++ b/tests/data/test653
@@ -67,7 +67,7 @@ s/boundary=------------------------[a-z0-9]*/boundary=--------------------------
 # (5*12) == 60 bytes less
 <protocol>
 POST /653 HTTP/1.1
 -Host: 127.0.0.1:8990
 +Host: 127.0.0.1:%HTTPPORT
 Accept: */*
 Content-Length: 150
 Content-Type: multipart/form-data; boundary=----------------------------
@@ -78,7 +78,7 @@ Content-Disposition: form-data; name="name"
 short value
 --------------------------------
 POST /653 HTTP/1.1
 -Host: 127.0.0.1:8990
 +Host: 127.0.0.1:%HTTPPORT
 Accept: */*
 Content-Length: 167
 Content-Type: multipart/form-data; boundary=----------------------------
 -- 
 2.26.2
--- a/SOURCES/0105-curl-7.63.0-lib1560-valgrind.patch
+++ b/SOURCES/0105-curl-7.63.0-lib1560-valgrind.patch
@ -1,39 +0,0 @@
 From f55cca0e86f59ec11ffafd5c0503c39ca3723e2e Mon Sep 17 00:00:00 2001
 From: Kamil Dudka <kdudka@redhat.com>
 Date: Mon, 4 Feb 2019 17:32:56 +0100
 Subject: [PATCH] libtest: compile lib1560.c with -fno-builtin-strcmp
 ... to prevent valgrind from reporting false positives on x86_64:
 Conditional jump or move depends on uninitialised value(s)
   at 0x10BCAA: part2id (lib1560.c:489)
   by 0x10BCAA: updateurl (lib1560.c:521)
   by 0x10BCAA: set_parts (lib1560.c:630)
   by 0x10BCAA: test (lib1560.c:802)
   by 0x4923412: (below main) (in /usr/lib64/libc-2.28.9000.so)
 Conditional jump or move depends on uninitialised value(s)
   at 0x10BCC3: part2id (lib1560.c:491)
   by 0x10BCC3: updateurl (lib1560.c:521)
   by 0x10BCC3: set_parts (lib1560.c:630)
   by 0x10BCC3: test (lib1560.c:802)
   by 0x4923412: (below main) (in /usr/lib64/libc-2.28.9000.so)
 ---
 tests/libtest/Makefile.inc | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
 index 080421b..ea3b806 100644
 --- a/tests/libtest/Makefile.inc
 +++ b/tests/libtest/Makefile.inc
@@ -593,6 +593,7 @@ lib1559_SOURCES = lib1559.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
 lib1559_LDADD = $(TESTUTIL_LIBS)
 lib1560_SOURCES = lib1560.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
 +lib1560_CFLAGS = $(AM_CFLAGS) -fno-builtin-strcmp
 lib1560_LDADD = $(TESTUTIL_LIBS)
 lib1564_SOURCES = lib1564.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
 -- 
 2.17.2
--- a/SPECS/curl.spec
+++ b/SPECS/curl.spec
`@ -1 +1 @@`
	`d38ab79ef7a6d92df91ca8dfcf9a5eaf7e25b725 SOURCES/curl-7.76.1.tar.xz`	`8b56123714b4e061f0f71005c5be598b12f82483 SOURCES/curl-7.61.1.tar.xz`
`@ -1 +1 @@`
	`SOURCES/curl-7.76.1.tar.xz`	`SOURCES/curl-7.61.1.tar.xz`