27 changed files with 1 additions and 7877 deletions
--- a/SOURCES/0036-curl-7.61.1-CVE-2022-22576.patch
+++ b/SOURCES/0036-curl-7.61.1-CVE-2022-22576.patch
@ -1,338 +0,0 @@
 From 295124c256ed25f097192cfa9a67e460f7bb587f Mon Sep 17 00:00:00 2001
 From: nao <naost3rn@gmail.com>
 Date: Tue, 21 Jan 2020 10:30:37 +0100
 Subject: [PATCH 1/2] http: move "oauth_bearer" from connectdata to Curl_easy
 Fixes the bug where oauth_bearer gets deallocated when we re-use a
 connection.
 Closes #4824
 Upstream-commit: dea17b519dc1d83265ca6aa9a484a2cf242db3b9
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/curl_sasl.c | 14 ++++++++------
 lib/http.c      | 12 +++++-------
 lib/url.c       |  9 ---------
 lib/urldata.h   |  2 --
 4 files changed, 13 insertions(+), 24 deletions(-)
 diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c
 index 354bc54..c767bef 100644
 --- a/lib/curl_sasl.c
 +++ b/lib/curl_sasl.c
@@ -269,6 +269,7 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn,
     data->set.str[STRING_SERVICE_NAME] :
     sasl->params->service;
 #endif
 +  const char *oauth_bearer = data->set.str[STRING_BEARER];
   sasl->force_ir = force_ir;    /* Latch for future use */
   sasl->authused = 0;           /* No mechanism used yet */
@@ -339,7 +340,7 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn,
       }
     else
 #endif
 -    if((enabledmechs & SASL_MECH_OAUTHBEARER) && conn->oauth_bearer) {
 +    if((enabledmechs & SASL_MECH_OAUTHBEARER) && oauth_bearer) {
       mech = SASL_MECH_STRING_OAUTHBEARER;
       state1 = SASL_OAUTH2;
       state2 = SASL_OAUTH2_RESP;
@@ -349,10 +350,10 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn,
         result = Curl_auth_create_oauth_bearer_message(data, conn->user,
                                                        hostname,
                                                        port,
 -                                                       conn->oauth_bearer,
 +                                                       oauth_bearer,
                                                        &resp, &len);
     }
 -    else if((enabledmechs & SASL_MECH_XOAUTH2) && conn->oauth_bearer) {
 +    else if((enabledmechs & SASL_MECH_XOAUTH2) && oauth_bearer) {
       mech = SASL_MECH_STRING_XOAUTH2;
       state1 = SASL_OAUTH2;
       sasl->authused = SASL_MECH_XOAUTH2;
@@ -360,7 +361,7 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn,
       if(force_ir || data->set.sasl_ir)
         result = Curl_auth_create_oauth_bearer_message(data, conn->user,
                                                        NULL, 0,
 -                                                       conn->oauth_bearer,
 +                                                       oauth_bearer,
                                                        &resp, &len);
     }
     else if(enabledmechs & SASL_MECH_PLAIN) {
@@ -429,6 +430,7 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct connectdata *conn,
   char *serverdata;
 #endif
   size_t len = 0;
 +  const char *oauth_bearer = data->set.str[STRING_BEARER];
   *progress = SASL_INPROGRESS;
@@ -556,7 +558,7 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct connectdata *conn,
       result = Curl_auth_create_oauth_bearer_message(data, conn->user,
                                                      hostname,
                                                      port,
 -                                                     conn->oauth_bearer,
 +                                                     oauth_bearer,
                                                      &resp, &len);
       /* Failures maybe sent by the server as continuations for OAUTHBEARER */
@@ -565,7 +567,7 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct connectdata *conn,
     else
       result = Curl_auth_create_oauth_bearer_message(data, conn->user,
                                                      NULL, 0,
 -                                                     conn->oauth_bearer,
 +                                                     oauth_bearer,
                                                      &resp, &len);
     break;
 diff --git a/lib/http.c b/lib/http.c
 index 26eb52d..bf19077 100644
 --- a/lib/http.c
 +++ b/lib/http.c
@@ -326,7 +326,7 @@ static CURLcode http_output_bearer(struct connectdata *conn)
   userp = &conn->allocptr.userpwd;
   free(*userp);
   *userp = aprintf("Authorization: Bearer %s\r\n",
 -                   conn->oauth_bearer);
 +                   conn->data->set.str[STRING_BEARER]);
   if(!*userp) {
     result = CURLE_OUT_OF_MEMORY;
@@ -510,7 +510,7 @@ CURLcode Curl_http_auth_act(struct connectdata *conn)
   CURLcode result = CURLE_OK;
   unsigned long authmask = ~0ul;
 -  if(!conn->oauth_bearer)
 +  if(!data->set.str[STRING_BEARER])
     authmask &= (unsigned long)~CURLAUTH_BEARER;
   if(100 <= data->req.httpcode && 199 >= data->req.httpcode)
@@ -520,7 +520,7 @@ CURLcode Curl_http_auth_act(struct connectdata *conn)
   if(data->state.authproblem)
     return data->set.http_fail_on_error?CURLE_HTTP_RETURNED_ERROR:CURLE_OK;
 -  if((conn->bits.user_passwd || conn->oauth_bearer) &&
 +  if((conn->bits.user_passwd || data->set.str[STRING_BEARER]) &&
      ((data->req.httpcode == 401) ||
       (conn->bits.authneg && data->req.httpcode < 300))) {
     pickhost = pickoneauth(&data->state.authhost, authmask);
@@ -590,9 +590,7 @@ output_auth_headers(struct connectdata *conn,
 {
   const char *auth = NULL;
   CURLcode result = CURLE_OK;
 -#if !defined(CURL_DISABLE_VERBOSE_STRINGS) || defined(USE_SPNEGO)
   struct Curl_easy *data = conn->data;
 -#endif
 #ifdef USE_SPNEGO
   struct negotiatedata *negdata = proxy ?
     &data->state.proxyneg : &data->state.negotiate;
@@ -664,7 +662,7 @@ output_auth_headers(struct connectdata *conn,
   }
   if(authstatus->picked == CURLAUTH_BEARER) {
     /* Bearer */
 -    if((!proxy && conn->oauth_bearer &&
 +    if((!proxy && data->set.str[STRING_BEARER] &&
         !Curl_checkheaders(conn, "Authorization:"))) {
       auth = "Bearer";
       result = http_output_bearer(conn);
@@ -722,7 +720,7 @@ Curl_http_output_auth(struct connectdata *conn,
   authproxy = &data->state.authproxy;
   if((conn->bits.httpproxy && conn->bits.proxy_user_passwd) ||
 -     conn->bits.user_passwd || conn->oauth_bearer)
 +     conn->bits.user_passwd || data->set.str[STRING_BEARER])
     /* continue please */;
   else {
     authhost->done = TRUE;
 diff --git a/lib/url.c b/lib/url.c
 index 4803653..fca0855 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -686,7 +686,6 @@ static void conn_free(struct connectdata *conn)
   Curl_safefree(conn->user);
   Curl_safefree(conn->passwd);
 -  Curl_safefree(conn->oauth_bearer);
   Curl_safefree(conn->options);
   Curl_safefree(conn->http_proxy.user);
   Curl_safefree(conn->socks_proxy.user);
@@ -4161,14 +4160,6 @@ static CURLcode create_conn(struct Curl_easy *data,
     }
   }
 -  if(data->set.str[STRING_BEARER]) {
 -    conn->oauth_bearer = strdup(data->set.str[STRING_BEARER]);
 -    if(!conn->oauth_bearer) {
 -      result = CURLE_OUT_OF_MEMORY;
 -      goto out;
 -    }
 -  }
 -
 #ifdef USE_UNIX_SOCKETS
   if(data->set.str[STRING_UNIX_SOCKET_PATH]) {
     conn->unix_domain_socket = strdup(data->set.str[STRING_UNIX_SOCKET_PATH]);
 diff --git a/lib/urldata.h b/lib/urldata.h
 index 72a36fb..73a185c 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -850,8 +850,6 @@ struct connectdata {
   char *passwd;  /* password string, allocated */
   char *options; /* options string, allocated */
 -  char *oauth_bearer; /* bearer token for OAuth 2.0, allocated */
 -
   int httpversion;        /* the HTTP version*10 reported by the server */
   int rtspversion;        /* the RTSP version*10 reported by the server */
 -- 
 2.34.1
 From 85d1103c2fc0c9b1bdfae470dbafd45758e1c2f0 Mon Sep 17 00:00:00 2001
 From: Patrick Monnerat <patrick@monnerat.net>
 Date: Mon, 25 Apr 2022 11:44:05 +0200
 Subject: [PATCH 2/2] url: check sasl additional parameters for connection
 reuse.
 Also move static function safecmp() as non-static Curl_safecmp() since
 its purpose is needed at several places.
 Bug: https://curl.se/docs/CVE-2022-22576.html
 CVE-2022-22576
 Closes #8746
 Upstream-commit: 852aa5ad351ea53e5f01d2f44b5b4370c2bf5425
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/strcase.c   | 10 ++++++++++
 lib/strcase.h   |  2 ++
 lib/url.c       | 12 +++++++++++-
 lib/urldata.h   |  2 ++
 lib/vtls/vtls.c | 19 +++++--------------
 5 files changed, 30 insertions(+), 15 deletions(-)
 diff --git a/lib/strcase.c b/lib/strcase.c
 index dd46ca1..692a3f1 100644
 --- a/lib/strcase.c
 +++ b/lib/strcase.c
@@ -165,6 +165,16 @@ void Curl_strntoupper(char *dest, const char *src, size_t n)
   } while(*src++ && --n);
 }
 +/* Compare case-sensitive NUL-terminated strings, taking care of possible
 + * null pointers. Return true if arguments match.
 + */
 +bool Curl_safecmp(char *a, char *b)
 +{
 +  if(a && b)
 +    return !strcmp(a, b);
 +  return !a && !b;
 +}
 +
 /* --- public functions --- */
 int curl_strequal(const char *first, const char *second)
 diff --git a/lib/strcase.h b/lib/strcase.h
 index b628656..382b80a 100644
 --- a/lib/strcase.h
 +++ b/lib/strcase.h
@@ -47,4 +47,6 @@ char Curl_raw_toupper(char in);
 void Curl_strntoupper(char *dest, const char *src, size_t n);
 +bool Curl_safecmp(char *a, char *b);
 +
 #endif /* HEADER_CURL_STRCASE_H */
 diff --git a/lib/url.c b/lib/url.c
 index adef2cd..94e3406 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -701,6 +701,7 @@ static void conn_free(struct connectdata *conn)
   Curl_safefree(conn->allocptr.host);
   Curl_safefree(conn->allocptr.cookiehost);
   Curl_safefree(conn->allocptr.rtsp_transport);
 +  Curl_safefree(conn->oauth_bearer);
   Curl_safefree(conn->trailer);
   Curl_safefree(conn->host.rawalloc); /* host name buffer */
   Curl_safefree(conn->conn_to_host.rawalloc); /* host name buffer */
@@ -1291,7 +1292,8 @@ ConnectionExists(struct Curl_easy *data,
         /* This protocol requires credentials per connection,
            so verify that we're using the same name and password as well */
         if(strcmp(needle->user, check->user) ||
 -           strcmp(needle->passwd, check->passwd)) {
 +           strcmp(needle->passwd, check->passwd) ||
 +           !Curl_safecmp(needle->oauth_bearer, check->oauth_bearer)) {
           /* one of them was different */
           continue;
         }
@@ -4160,6 +4162,14 @@ static CURLcode create_conn(struct Curl_easy *data,
     }
   }
 +  if(data->set.str[STRING_BEARER]) {
 +    conn->oauth_bearer = strdup(data->set.str[STRING_BEARER]);
 +    if(!conn->oauth_bearer) {
 +      result = CURLE_OUT_OF_MEMORY;
 +      goto out;
 +    }
 +  }
 +
 #ifdef USE_UNIX_SOCKETS
   if(data->set.str[STRING_UNIX_SOCKET_PATH]) {
     conn->unix_domain_socket = strdup(data->set.str[STRING_UNIX_SOCKET_PATH]);
 diff --git a/lib/urldata.h b/lib/urldata.h
 index cc8a600..03da59a 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -850,6 +850,8 @@ struct connectdata {
   char *passwd;  /* password string, allocated */
   char *options; /* options string, allocated */
 +  char *oauth_bearer; /* OAUTH2 bearer, allocated */
 +
   int httpversion;        /* the HTTP version*10 reported by the server */
   int rtspversion;        /* the RTSP version*10 reported by the server */
 diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
 index 03b85ba..a40ac06 100644
 --- a/lib/vtls/vtls.c
 +++ b/lib/vtls/vtls.c
@@ -82,15 +82,6 @@
   else                                       \
     dest->var = NULL;
 -static bool safecmp(char *a, char *b)
 -{
 -  if(a && b)
 -    return !strcmp(a, b);
 -  else if(!a && !b)
 -    return TRUE; /* match */
 -  return FALSE; /* no match */
 -}
 -
 bool
 Curl_ssl_config_matches(struct ssl_primary_config* data,
                         struct ssl_primary_config* needle)
@@ -100,11 +91,11 @@ Curl_ssl_config_matches(struct ssl_primary_config* data,
      (data->verifypeer == needle->verifypeer) &&
      (data->verifyhost == needle->verifyhost) &&
      (data->verifystatus == needle->verifystatus) &&
 -     safecmp(data->CApath, needle->CApath) &&
 -     safecmp(data->CAfile, needle->CAfile) &&
 -     safecmp(data->clientcert, needle->clientcert) &&
 -     safecmp(data->random_file, needle->random_file) &&
 -     safecmp(data->egdsocket, needle->egdsocket) &&
 +     Curl_safecmp(data->CApath, needle->CApath) &&
 +     Curl_safecmp(data->CAfile, needle->CAfile) &&
 +     Curl_safecmp(data->clientcert, needle->clientcert) &&
 +     Curl_safecmp(data->random_file, needle->random_file) &&
 +     Curl_safecmp(data->egdsocket, needle->egdsocket) &&
      Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) &&
      Curl_safe_strcasecompare(data->cipher_list13, needle->cipher_list13))
     return TRUE;
 -- 
 2.34.1
--- a/SOURCES/0037-curl-7.61.1-CVE-2022-27776.patch
+++ b/SOURCES/0037-curl-7.61.1-CVE-2022-27776.patch
@ -1,710 +0,0 @@
 From 24ff6b126726201cf778038c332b3b921c7f5b2f Mon Sep 17 00:00:00 2001
 From: Katsuhiko YOSHIDA <claddvd@gmail.com>
 Date: Sun, 30 Dec 2018 09:44:30 +0900
 Subject: [PATCH 1/6] cookies: skip custom cookies when redirecting cross-site
 Closes #3417
 Upstream-commit: 1f30dc886d1a4a6e81599a9f5f5e9f60d97801d4
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 docs/libcurl/opts/CURLOPT_HTTPHEADER.3 |  4 ++
 lib/http.c                             |  3 +-
 tests/data/Makefile.inc                |  2 +-
 tests/data/test330                     | 90 ++++++++++++++++++++++++++
 4 files changed, 97 insertions(+), 2 deletions(-)
 create mode 100644 tests/data/test330
 diff --git a/docs/libcurl/opts/CURLOPT_HTTPHEADER.3 b/docs/libcurl/opts/CURLOPT_HTTPHEADER.3
 index f5826e1..4af69f4 100644
 --- a/docs/libcurl/opts/CURLOPT_HTTPHEADER.3
 +++ b/docs/libcurl/opts/CURLOPT_HTTPHEADER.3
@@ -88,6 +88,10 @@ those servers will get all the contents of your custom headers too.
 Starting in 7.58.0, libcurl will specifically prevent "Authorization:" headers
 from being sent to other hosts than the first used one, unless specifically
 permitted with the \fICURLOPT_UNRESTRICTED_AUTH(3)\fP option.
 +
 +Starting in 7.64.0, libcurl will specifically prevent "Cookie:" headers
 +from being sent to other hosts than the first used one, unless specifically
 +permitted with the \fICURLOPT_UNRESTRICTED_AUTH(3)\fP option.
 .SH DEFAULT
 NULL
 .SH PROTOCOLS
 diff --git a/lib/http.c b/lib/http.c
 index bf19077..0b5e476 100644
 --- a/lib/http.c
 +++ b/lib/http.c
@@ -1774,7 +1774,8 @@ CURLcode Curl_add_custom_headers(struct connectdata *conn,
                   checkprefix("Transfer-Encoding:", headers->data))
             /* HTTP/2 doesn't support chunked requests */
             ;
 -          else if(checkprefix("Authorization:", headers->data) &&
 +          else if((checkprefix("Authorization:", headers->data) ||
 +                   checkprefix("Cookie:", headers->data)) &&
                   /* be careful of sending this potentially sensitive header to
                      other hosts */
                   (data->state.this_is_a_follow &&
 diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
 index e0f1ef4..77e85fd 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
@@ -56,7 +56,7 @@ test289 test290 test291 test292 test293 test294 test295 test296 test297 \
 test298 test299 test300 test301 test302 test303 test304 test305 test306 \
 test307 test308 test309 test310 test311 test312 test313 test314 test315 \
 test316 test317 test318 test319 test320 test321 test322 test323 test324 \
 -test325 test326 \
 +test325 test326 test330 \
 \
 test340 \
 \
 diff --git a/tests/data/test330 b/tests/data/test330
 new file mode 100644
 index 0000000..74607d5
 --- /dev/null
 +++ b/tests/data/test330
@@ -0,0 +1,90 @@
 +<testcase>
 +<info>
 +<keywords>
 +HTTP
 +followlocation
 +cookies
 +</keywords>
 +</info>
 +#
 +# Server-side
 +<reply>
 +<data>
 +HTTP/1.1 302 OK
 +Date: Thu, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake swsclose
 +Content-Type: text/html
 +Funny-head: yesyes
 +Location: http://goto.second.host.now/3170002
 +Content-Length: 8
 +Connection: close
 +
 +contents
 +</data>
 +<data2>
 +HTTP/1.1 200 OK
 +Date: Thu, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake swsclose
 +Content-Type: text/html
 +Funny-head: yesyes
 +Content-Length: 9
 +
 +contents
 +</data2>
 +
 +<datacheck>
 +HTTP/1.1 302 OK
 +Date: Thu, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake swsclose
 +Content-Type: text/html
 +Funny-head: yesyes
 +Location: http://goto.second.host.now/3170002
 +Content-Length: 8
 +Connection: close
 +
 +HTTP/1.1 200 OK
 +Date: Thu, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake swsclose
 +Content-Type: text/html
 +Funny-head: yesyes
 +Content-Length: 9
 +
 +contents
 +</datacheck>
 +</reply>
 +
 +#
 +# Client-side
 +<client>
 +<server>
 +http
 +</server>
 + <name>
 +HTTP with custom Cookie: and redirect to new host
 + </name>
 + <command>
 +http://first.host.it.is/we/want/that/page/317 -x %HOSTIP:%HTTPPORT -H "Cookie: test=yes" --location
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<strip>
 +^User-Agent:.*
 +</strip>
 +<protocol>
 +GET http://first.host.it.is/we/want/that/page/317 HTTP/1.1
 +Host: first.host.it.is
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +Cookie: test=yes
 +
 +GET http://goto.second.host.now/3170002 HTTP/1.1
 +Host: goto.second.host.now
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +
 +</protocol>
 +</verify>
 +</testcase>
 -- 
 2.34.1
 From a3f3855c8bf3a39ef0d86ef04087c200bca765f1 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 19 Dec 2019 16:45:53 +0100
 Subject: [PATCH 2/6] sws: search for "Testno:" header uncondtionally if no
 testno
 Even if the initial request line wasn't found. With the fix to 1455, the
 test number is now detected correctly.
 (Problem found when running tests in random order.)
 Closes #4744
 Upstream-commit: 25b69c482f45c7acd817920bd8fdf68887be51a2
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/data/test1455 |  3 ++-
 tests/server/sws.c  | 40 +++++++++++++++++++++++-----------------
 2 files changed, 25 insertions(+), 18 deletions(-)
 diff --git a/tests/data/test1455 b/tests/data/test1455
 index 0b77dc4..25f742e 100644
 --- a/tests/data/test1455
 +++ b/tests/data/test1455
@@ -35,7 +35,7 @@ http
 HTTP GET when PROXY Protocol enabled
 </name>
 <command>
 -http://%HOSTIP:%HTTPPORT/1455 --haproxy-protocol
 +http://%HOSTIP:%HTTPPORT/1455 --haproxy-protocol -H "Testno: 1455"
 </command>
 </client>
@@ -53,6 +53,7 @@ proxy-line
 GET /1455 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
 +Testno: 1455
 </protocol>
 </verify>
 diff --git a/tests/server/sws.c b/tests/server/sws.c
 index fbe7761..4ece830 100644
 --- a/tests/server/sws.c
 +++ b/tests/server/sws.c
@@ -367,6 +367,8 @@ static int parse_servercmd(struct httprequest *req)
   filename = test2file(req->testno);
   req->close = FALSE;
 +  req->connmon = FALSE;
 +
   stream = fopen(filename, "rb");
   if(!stream) {
     error = errno;
@@ -391,8 +393,6 @@ static int parse_servercmd(struct httprequest *req)
       return 1; /* done */
     }
 -    req->connmon = FALSE;
 -
     cmd = orgcmd;
     while(cmd && cmdsize) {
       char *check;
@@ -548,12 +548,11 @@ static int ProcessRequest(struct httprequest *req)
         snprintf(logbuf, sizeof(logbuf), "Requested test number %ld part %ld",
                  req->testno, req->partno);
         logmsg("%s", logbuf);
 -
 -        /* find and parse <servercmd> for this test */
 -        parse_servercmd(req);
       }
 -      else
 +      else {
 +        logmsg("No test number");
         req->testno = DOCNUMBER_NOTHING;
 +      }
     }
@@ -613,14 +612,6 @@ static int ProcessRequest(struct httprequest *req)
       }
     }
 -    if(req->testno == DOCNUMBER_NOTHING) {
 -      /* check for a Testno: header with the test case number */
 -      char *testno = strstr(line, "\nTestno: ");
 -      if(testno) {
 -        req->testno = strtol(&testno[9], NULL, 10);
 -        logmsg("Found test number %d in Testno: header!", req->testno);
 -      }
 -    }
     if(req->testno == DOCNUMBER_NOTHING) {
       /* Still no test case number. Try to get the the number off the last dot
          instead, IE we consider the TLD to be the test number. Test 123 can
@@ -661,8 +652,8 @@ static int ProcessRequest(struct httprequest *req)
     }
   }
   else if((req->offset >= 3) && (req->testno == DOCNUMBER_NOTHING)) {
 -    logmsg("** Unusual request. Starts with %02x %02x %02x",
 -           line[0], line[1], line[2]);
 +    logmsg("** Unusual request. Starts with %02x %02x %02x (%c%c%c)",
 +           line[0], line[1], line[2], line[0], line[1], line[2]);
   }
   if(!end) {
@@ -670,7 +661,22 @@ static int ProcessRequest(struct httprequest *req)
     logmsg("request not complete yet");
     return 0; /* not complete yet */
   }
 -  logmsg("- request found to be complete");
 +  logmsg("- request found to be complete (%d)", req->testno);
 +
 +  if(req->testno == DOCNUMBER_NOTHING) {
 +    /* check for a Testno: header with the test case number */
 +    char *testno = strstr(line, "\nTestno: ");
 +    if(testno) {
 +      req->testno = strtol(&testno[9], NULL, 10);
 +      logmsg("Found test number %d in Testno: header!", req->testno);
 +    }
 +    else {
 +      logmsg("No Testno: header");
 +    }
 +  }
 +
 +  /* find and parse <servercmd> for this test */
 +  parse_servercmd(req);
   if(use_gopher) {
     /* when using gopher we cannot check the request until the entire
 -- 
 2.34.1
 From 3772ea764c05a1cf37b96c091ae266138e8a2867 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 16 Apr 2020 14:16:22 +0200
 Subject: [PATCH 3/6] runtests: always put test number in servercmd file
 Upstream-commit: d1a2816b4128faa8ebc50ce93285c7364652856e
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/runtests.pl | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)
 diff --git a/tests/runtests.pl b/tests/runtests.pl
 index a0fd991..8d8ed81 100755
 --- a/tests/runtests.pl
 +++ b/tests/runtests.pl
@@ -3878,10 +3878,9 @@ sub singletest {
     unlink($SERVER2IN);
     unlink($PROXYIN);
 -    if(@ftpservercmd) {
 -        # write the instructions to file
 -        writearray($FTPDCMD, \@ftpservercmd);
 -    }
 +    push @ftpservercmd, "Testnum $testnum\n";
 +    # write the instructions to file
 +    writearray($FTPDCMD, \@ftpservercmd);
     # get the command line options to use
     my @blaha;
@@ -4222,9 +4221,6 @@ sub singletest {
         }
     }
 -    # remove the test server commands file after each test
 -    unlink($FTPDCMD) if(-f $FTPDCMD);
 -
     # run the postcheck command
     my @postcheck= getpart("client", "postcheck");
     if(@postcheck) {
 -- 
 2.34.1
 From ac04f6feaa19c636aa09a1b50643d70a77be4465 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 14 May 2020 17:45:40 +0200
 Subject: [PATCH 4/6] sws: as last resort, get test number from server cmd file
 If it can't be found in the request. Also support --cmdfile to set it to
 a custom file name.
 runtests.pl always writes this file with the test number in it since a
 while back.
 Upstream-commit: a3b0699d5c110270f09ac51b5b465ca8753b35a9
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/server/sws.c | 68 ++++++++++++++++++++++++++++++++++------------
 1 file changed, 51 insertions(+), 17 deletions(-)
 diff --git a/tests/server/sws.c b/tests/server/sws.c
 index 4ece830..2696872 100644
 --- a/tests/server/sws.c
 +++ b/tests/server/sws.c
@@ -155,6 +155,10 @@ const char *serverlogfile = DEFAULT_LOGFILE;
 #define REQUEST_PROXY_DUMP  "log/proxy.input"
 #define RESPONSE_PROXY_DUMP "log/proxy.response"
 +/* file in which additional instructions may be found */
 +#define DEFAULT_CMDFILE "log/ftpserver.cmd"
 +const char *cmdfile = DEFAULT_CMDFILE;
 +
 /* very-big-path support */
 #define MAXDOCNAMELEN 140000
 #define MAXDOCNAMELEN_TXT "139999"
@@ -358,6 +362,24 @@ static bool socket_domain_is_ip(void)
   }
 }
 +/* parse the file on disk that might have a test number for us */
 +static int parse_cmdfile(struct httprequest *req)
 +{
 +  int testnum = DOCNUMBER_NOTHING;
 +  char buf[256];
 +  FILE *f = fopen(cmdfile, FOPEN_READTEXT);
 +  if(f) {
 +    while(fgets(buf, sizeof(buf), f)) {
 +      if(1 == sscanf(buf, "Testnum %d", &testnum)) {
 +        logmsg("[%s] cmdfile says testnum %d", cmdfile, testnum);
 +        req->testno = testnum;
 +      }
 +    }
 +    fclose(f);
 +  }
 +  return 0;
 +}
 +
 /* based on the testno, parse the correct server commands */
 static int parse_servercmd(struct httprequest *req)
 {
@@ -622,34 +644,41 @@ static int ProcessRequest(struct httprequest *req)
       /* get the number after it */
       if(ptr) {
 +        long num;
         ptr++; /* skip the dot */
 -        req->testno = strtol(ptr, &ptr, 10);
 +        num = strtol(ptr, &ptr, 10);
 -        if(req->testno > 10000) {
 -          req->partno = req->testno % 10000;
 -          req->testno /= 10000;
 +        if(num) {
 +          req->testno = num;
 +          if(req->testno > 10000) {
 +            req->partno = req->testno % 10000;
 +            req->testno /= 10000;
 -          logmsg("found test %d in requested host name", req->testno);
 +            logmsg("found test %d in requested host name", req->testno);
 +          }
 +          else
 +            req->partno = 0;
         }
 -        else
 -          req->partno = 0;
 -        snprintf(logbuf, sizeof(logbuf),
 -                 "Requested test number %ld part %ld (from host name)",
 +        if(req->testno != DOCNUMBER_NOTHING) {
 +          logmsg("Requested test number %ld part %ld (from host name)",
                  req->testno, req->partno);
 -        logmsg("%s", logbuf);
 -
 +        }
       }
 +    }
 -      if(!req->testno) {
 -        logmsg("Did not find test number in PATH");
 -        req->testno = DOCNUMBER_404;
 -      }
 -      else
 -        parse_servercmd(req);
 +    if(req->testno == DOCNUMBER_NOTHING)
 +      /* might get the test number */
 +      parse_cmdfile(req);
 +
 +    if(req->testno == DOCNUMBER_NOTHING) {
 +      logmsg("Did not find test number in PATH");
 +      req->testno = DOCNUMBER_404;
     }
 +    else
 +      parse_servercmd(req);
   }
   else if((req->offset >= 3) && (req->testno == DOCNUMBER_NOTHING)) {
     logmsg("** Unusual request. Starts with %02x %02x %02x (%c%c%c)",
@@ -2038,6 +2067,11 @@ int main(int argc, char *argv[])
       if(argc>arg)
         serverlogfile = argv[arg++];
     }
 +    else if(!strcmp("--cmdfile", argv[arg])) {
 +      arg++;
 +      if(argc>arg)
 +        cmdfile = argv[arg++];
 +    }
     else if(!strcmp("--gopher", argv[arg])) {
       arg++;
       use_gopher = TRUE;
 -- 
 2.34.1
 From 9fa56a1e3ae7feff14668d8abd892fa028a9f32e Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 25 Apr 2022 13:05:40 +0200
 Subject: [PATCH 5/6] http: avoid auth/cookie on redirects same host diff port
 CVE-2022-27776
 Reported-by: Harry Sintonen
 Bug: https://curl.se/docs/CVE-2022-27776.html
 Closes #8749
 Upstream-commit: 6e659993952aa5f90f48864be84a1bbb047fc258
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/http.c    | 33 +++++++++++++++++++++------------
 lib/urldata.h | 16 +++++++++-------
 2 files changed, 30 insertions(+), 19 deletions(-)
 diff --git a/lib/http.c b/lib/http.c
 index 0b5e476..39fc7aa 100644
 --- a/lib/http.c
 +++ b/lib/http.c
@@ -688,6 +688,21 @@ output_auth_headers(struct connectdata *conn,
   return CURLE_OK;
 }
 +/*
 + * allow_auth_to_host() tells if autentication, cookies or other "sensitive
 + * data" can (still) be sent to this host.
 + */
 +static bool allow_auth_to_host(struct connectdata *conn)
 +{
 +  struct Curl_easy *data = conn->data;
 +  return (!data->state.this_is_a_follow ||
 +          data->set.allow_auth_to_other_hosts ||
 +          (data->state.first_host &&
 +           strcasecompare(data->state.first_host, conn->host.name) &&
 +           (data->state.first_remote_port == conn->remote_port) &&
 +           (data->state.first_remote_protocol == conn->handler->protocol)));
 +}
 +
 /**
  * Curl_http_output_auth() setups the authentication headers for the
  * host/proxy and the correct authentication
@@ -756,15 +771,11 @@ Curl_http_output_auth(struct connectdata *conn,
        with it */
     authproxy->done = TRUE;
 -  /* To prevent the user+password to get sent to other than the original
 -     host due to a location-follow, we do some weirdo checks here */
 -  if(!data->state.this_is_a_follow ||
 -     conn->bits.netrc ||
 -     !data->state.first_host ||
 -     data->set.allow_auth_to_other_hosts ||
 -     strcasecompare(data->state.first_host, conn->host.name)) {
 +  /* To prevent the user+password to get sent to other than the original host
 +     due to a location-follow */
 +  if(allow_auth_to_host(conn)
 +     || conn->bits.netrc)
     result = output_auth_headers(conn, authhost, request, path, FALSE);
 -  }
   else
     authhost->done = TRUE;
@@ -1778,10 +1789,7 @@ CURLcode Curl_add_custom_headers(struct connectdata *conn,
                    checkprefix("Cookie:", headers->data)) &&
                   /* be careful of sending this potentially sensitive header to
                      other hosts */
 -                  (data->state.this_is_a_follow &&
 -                   data->state.first_host &&
 -                   !data->set.allow_auth_to_other_hosts &&
 -                   !strcasecompare(data->state.first_host, conn->host.name)))
 +                  !allow_auth_to_host(conn))
             ;
           else {
             result = Curl_add_bufferf(req_buffer, "%s\r\n", headers->data);
@@ -1937,6 +1945,7 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
       return CURLE_OUT_OF_MEMORY;
     data->state.first_remote_port = conn->remote_port;
 +    data->state.first_remote_protocol = conn->handler->protocol;
   }
   http->writebytecount = http->readbytecount = 0;
 diff --git a/lib/urldata.h b/lib/urldata.h
 index d3b971c..4bb0a84 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -1231,13 +1231,15 @@ struct UrlState {
                                 bytes / second */
   bool this_is_a_follow; /* this is a followed Location: request */
   bool refused_stream; /* this was refused, try again */
 -  char *first_host; /* host name of the first (not followed) request.
 -                       if set, this should be the host name that we will
 -                       sent authorization to, no else. Used to make Location:
 -                       following not keep sending user+password... This is
 -                       strdup() data.
 -                    */
 -  int first_remote_port; /* remote port of the first (not followed) request */
 +
 +  /* host name, port number and protocol of the first (not followed) request.
 +     if set, this should be the host name that we will sent authorization to,
 +     no else. Used to make Location: following not keep sending user+password.
 +     This is strdup()ed data. */
 +  char *first_host;
 +  int first_remote_port;
 +  unsigned int first_remote_protocol;
 +
   struct curl_ssl_session *session; /* array of 'max_ssl_sessions' size */
   long sessionage;                  /* number of the most recent session */
   unsigned int tempcount; /* number of entries in use in tempwrite, 0 - 3 */
 -- 
 2.34.1
 From a8bb1e37e22788abaca37c59cf447d690fdcdfa4 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 25 Apr 2022 13:05:47 +0200
 Subject: [PATCH 6/6] test898: verify the fix for CVE-2022-27776
 Do not pass on Authorization headers on redirects to another port
 Upstream-commit: afe752e0504ab60bf63787ede0b992cbe1065f78
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/data/Makefile.inc |  2 +-
 tests/data/test898      | 91 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 92 insertions(+), 1 deletion(-)
 create mode 100644 tests/data/test898
 diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
 index 77e85fd..58c9e31 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
@@ -99,7 +99,7 @@ test850 test851 test852 test853 test854 test855 test856 test857 test858 \
 test859 test860 test861 test862 test863 test864 test865 test866 test867 \
 test868 test869 test870 test871 test872 test873 test874 test875 test876 \
 test877 test878 test879 test880 test881 test882 test883 test884 test885 \
 -test886 test887 test888 test889 test890 test891 \
 +test886 test887 test888 test889 test890 test891 test898 \
 \
 test900 test901 test902 test903 test904 test905 test906 test907 test908 \
 test909 test910 test911 test912 test913 test914 test915 test916 test917 \
 diff --git a/tests/data/test898 b/tests/data/test898
 new file mode 100644
 index 0000000..e295c26
 --- /dev/null
 +++ b/tests/data/test898
@@ -0,0 +1,91 @@
 +<testcase>
 +<info>
 +<keywords>
 +HTTP
 +--location
 +Authorization
 +Cookie
 +</keywords>
 +</info>
 +
 +#
 +# Server-side
 +<reply>
 +<data>
 +HTTP/1.1 301 redirect
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
 +Location: http://firsthost.com:9999/a/path/8980002
 +
 +</data>
 +<data2>
 +HTTP/1.1 200 OK
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 4
 +Connection: close
 +Content-Type: text/html
 +
 +hey
 +</data2>
 +
 +<datacheck>
 +HTTP/1.1 301 redirect
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
 +Location: http://firsthost.com:9999/a/path/8980002
 +
 +HTTP/1.1 200 OK
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 4
 +Connection: close
 +Content-Type: text/html
 +
 +hey
 +</datacheck>
 +
 +</reply>
 +
 +#
 +# Client-side
 +<client>
 +<server>
 +http
 +</server>
 + <name>
 +HTTP with custom auth and cookies redirected to HTTP on a diff port
 + </name>
 + <command>
 +-x http://%HOSTIP:%HTTPPORT http://firsthost.com -L -H "Authorization: Basic am9lOnNlY3JldA==" -H "Cookie: userpwd=am9lOnNlY3JldA=="
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<strip>
 +^User-Agent:.*
 +</strip>
 +<protocol>
 +GET http://firsthost.com/ HTTP/1.1
 +Host: firsthost.com
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +Authorization: Basic am9lOnNlY3JldA==
 +Cookie: userpwd=am9lOnNlY3JldA==
 +
 +GET http://firsthost.com:9999/a/path/8980002 HTTP/1.1
 +Host: firsthost.com:9999
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +
 +</protocol>
 +</verify>
 +</testcase>
 -- 
 2.34.1
--- a/SOURCES/0038-curl-7.61.1-CVE-2022-27774.patch
+++ b/SOURCES/0038-curl-7.61.1-CVE-2022-27774.patch
@ -1,714 +0,0 @@
 From 48f126157d36962e458bf12f90b50cfcef26eee9 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 25 Apr 2022 16:24:33 +0200
 Subject: [PATCH 1/4] connect: store "conn_remote_port" in the info struct
 To make it available after the connection ended.
 Upstream-commit: 08b8ef4e726ba10f45081ecda5b3cea788d3c839
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/connect.c | 1 +
 lib/urldata.h | 6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)
 diff --git a/lib/connect.c b/lib/connect.c
 index f724646..12a8aae 100644
 --- a/lib/connect.c
 +++ b/lib/connect.c
@@ -614,6 +614,7 @@ void Curl_persistconninfo(struct connectdata *conn)
   conn->data->info.conn_scheme = conn->handler->scheme;
   conn->data->info.conn_protocol = conn->handler->protocol;
   conn->data->info.conn_primary_port = conn->primary_port;
 +  conn->data->info.conn_remote_port = conn->remote_port;
   conn->data->info.conn_local_port = conn->local_port;
 }
 diff --git a/lib/urldata.h b/lib/urldata.h
 index 4bb0a84..cadf0e5 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -1050,7 +1050,11 @@ struct PureInfo {
      reused, in the connection cache. */
   char conn_primary_ip[MAX_IPADR_LEN];
 -  long conn_primary_port;
 +  long conn_primary_port;/* this is the destination port to the connection,
 +                            which might have been a proxy */
 +  int conn_remote_port;  /* this is the "remote port", which is the port
 +                            number of the used URL, independent of proxy or
 +                            not */
   char conn_local_ip[MAX_IPADR_LEN];
   long conn_local_port;
 -- 
 2.34.1
 From 6307fa6f9784402ba58697f46ba04354225391b7 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 25 Apr 2022 16:24:33 +0200
 Subject: [PATCH 2/4] transfer: redirects to other protocols or ports clear
 auth
 ... unless explicitly permitted.
 Bug: https://curl.se/docs/CVE-2022-27774.html
 Reported-by: Harry Sintonen
 Closes #8748
 Upstream-commit: 620ea21410030a9977396b4661806bc187231b79
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/transfer.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++
 lib/url.c      | 27 ++++++++++++++--------
 lib/urldata.h  |  1 +
 3 files changed, 81 insertions(+), 10 deletions(-)
 diff --git a/lib/transfer.c b/lib/transfer.c
 index ad5a7ba..2022cba 100644
 --- a/lib/transfer.c
 +++ b/lib/transfer.c
@@ -1370,6 +1370,7 @@ CURLcode Curl_pretransfer(struct Curl_easy *data)
   data->state.wildcardmatch = data->set.wildcard_enabled;
   data->set.followlocation = 0; /* reset the location-follow counter */
   data->state.this_is_a_follow = FALSE; /* reset this */
 +  data->state.this_is_a_follow_without_auth = FALSE;
   data->state.errorbuf = FALSE; /* no error has occurred */
   data->state.httpversion = 0; /* don't assume any particular server version */
@@ -1554,6 +1555,68 @@ CURLcode Curl_follow(struct Curl_easy *data,
   }
 +  /* Clear auth if this redirects to a different port number or protocol,
 +     unless permitted */
 +  if(!data->set.allow_auth_to_other_hosts && (type != FOLLOW_FAKE)) {
 +    int port;
 +    bool clear = FALSE;
 +
 +    CURLU *u = curl_url();
 +    if(!u)
 +      return CURLE_OUT_OF_MEMORY;
 +
 +    uc = curl_url_set(u, CURLUPART_URL, newurl,
 +        ((type == FOLLOW_REDIR) ? CURLU_URLENCODE : 0));
 +    if(uc) {
 +      infof(data, "Clear auth, curl_url_set() failed\n");
 +      clear = TRUE;
 +    }
 +
 +    if(!clear) {
 +      if(data->set.use_port && data->state.allow_port)
 +        /* a custom port is used */
 +        port = (int)data->set.use_port;
 +      else {
 +        char *portnum;
 +        uc = curl_url_get(u, CURLUPART_PORT, &portnum, CURLU_DEFAULT_PORT);
 +        if(uc) {
 +          infof(data, "Clear auth, failed to parse port number\n");
 +          clear = TRUE;
 +        }
 +        else {
 +          port = atoi(portnum);
 +          free(portnum);
 +        }
 +      }
 +    }
 +    if(!clear && port != data->info.conn_remote_port) {
 +      infof(data, "Clear auth, redirects to port from %u to %u\n",
 +            data->info.conn_remote_port, port);
 +      clear = TRUE;
 +    }
 +    if(!clear) {
 +      char *scheme;
 +      const struct Curl_handler *p;
 +      uc = curl_url_get(u, CURLUPART_SCHEME, &scheme, 0);
 +      if(uc) {
 +        infof(data, "Clear auth, failed to parse scheme\n");
 +        clear = TRUE;
 +      }
 +      else {
 +        p = Curl_builtin_scheme(scheme);
 +        if(p && (p->protocol != data->info.conn_protocol)) {
 +          infof(data, "Clear auth, redirects scheme from %s to %s\n",
 +                data->info.conn_scheme, scheme);
 +          clear = TRUE;
 +        }
 +        free(scheme);
 +      }
 +    }
 +    if(clear)
 +      data->state.this_is_a_follow_without_auth = TRUE;
 +    curl_url_cleanup(u);
 +  }
 +
   if(type == FOLLOW_FAKE) {
     /* we're only figuring out the new url if we would've followed locations
        but now we're done so we can get out! */
 diff --git a/lib/url.c b/lib/url.c
 index ed3c933..7dd5267 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -3483,18 +3483,25 @@ static CURLcode override_login(struct Curl_easy *data,
                                struct connectdata *conn,
                                char **userp, char **passwdp, char **optionsp)
 {
 -  if(data->set.str[STRING_USERNAME]) {
 -    free(*userp);
 -    *userp = strdup(data->set.str[STRING_USERNAME]);
 -    if(!*userp)
 -      return CURLE_OUT_OF_MEMORY;
 +  if(data->state.this_is_a_follow
 +      && data->state.this_is_a_follow_without_auth)
 +  {
 +    conn->bits.user_passwd = FALSE;
   }
 +  else {
 +    if(data->set.str[STRING_USERNAME]) {
 +      free(*userp);
 +      *userp = strdup(data->set.str[STRING_USERNAME]);
 +      if(!*userp)
 +        return CURLE_OUT_OF_MEMORY;
 +    }
 -  if(data->set.str[STRING_PASSWORD]) {
 -    free(*passwdp);
 -    *passwdp = strdup(data->set.str[STRING_PASSWORD]);
 -    if(!*passwdp)
 -      return CURLE_OUT_OF_MEMORY;
 +    if(data->set.str[STRING_PASSWORD]) {
 +      free(*passwdp);
 +      *passwdp = strdup(data->set.str[STRING_PASSWORD]);
 +      if(!*passwdp)
 +        return CURLE_OUT_OF_MEMORY;
 +    }
   }
   if(data->set.str[STRING_OPTIONS]) {
 diff --git a/lib/urldata.h b/lib/urldata.h
 index cadf0e5..026684b 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -1234,6 +1234,7 @@ struct UrlState {
   curl_off_t current_speed;  /* the ProgressShow() function sets this,
                                 bytes / second */
   bool this_is_a_follow; /* this is a followed Location: request */
 +  bool this_is_a_follow_without_auth;
   bool refused_stream; /* this was refused, try again */
   /* host name, port number and protocol of the first (not followed) request.
 -- 
 2.34.1
 From b142f97840dfb033a1776d5a2986385da7753224 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 25 Apr 2022 16:24:33 +0200
 Subject: [PATCH 3/4] tests: verify the fix for CVE-2022-27774
 - Test 973 redirects from HTTP to FTP, clear auth
 - Test 974 redirects from HTTP to HTTP different port, clear auth
 - Test 975 redirects from HTTP to FTP, permitted to keep auth
 - Test 976 redirects from HTTP to HTTP different port, permitted to keep
   auth
 Upstream-commit: 5295e8d64ac6949ecb3f9e564317a608f51b90d8
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/data/Makefile.inc |  1 +
 tests/data/test973      | 90 +++++++++++++++++++++++++++++++++++++++++
 tests/data/test974      | 88 ++++++++++++++++++++++++++++++++++++++++
 tests/data/test975      | 90 +++++++++++++++++++++++++++++++++++++++++
 tests/data/test976      | 89 ++++++++++++++++++++++++++++++++++++++++
 5 files changed, 358 insertions(+)
 create mode 100644 tests/data/test973
 create mode 100644 tests/data/test974
 create mode 100644 tests/data/test975
 create mode 100644 tests/data/test976
 diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
 index 58c9e31..6c920ff 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
@@ -108,6 +108,7 @@ test927 test928 test929 test930 test931 test932 test933 test934 test935 \
 test936 test937 test938 test939 test940 test941 test942 test943 test944 \
 test945 test946 test947 test948 test949 test950 test951 test952 \
 \
 +test973 test974 test975 test976 \
 test980 test981 test982 test983 test984 test985 test986 \
 \
 test1000 test1001 test1002 test1003 test1004 test1005 test1006 test1007 \
 diff --git a/tests/data/test973 b/tests/data/test973
 new file mode 100644
 index 0000000..6fe6ce0
 --- /dev/null
 +++ b/tests/data/test973
@@ -0,0 +1,90 @@
 +<testcase>
 +<info>
 +<keywords>
 +HTTP
 +FTP
 +--location
 +</keywords>
 +</info>
 +
 +#
 +# Server-side
 +<reply>
 +<data>
 +HTTP/1.1 301 redirect
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
 +Location: ftp://127.0.0.1:8992/a/path/9730002
 +
 +</data>
 +<data2>
 +data
 +    to
 +      see
 +that FTP
 +works
 +  so does it?
 +</data2>
 +
 +<datacheck>
 +HTTP/1.1 301 redirect
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
 +Location: ftp://127.0.0.1:8992/a/path/9730002
 +
 +data
 +    to
 +      see
 +that FTP
 +works
 +  so does it?
 +</datacheck>
 +
 +</reply>
 +
 +#
 +# Client-side
 +<client>
 +<server>
 +http
 +ftp
 +</server>
 + <name>
 +HTTP with auth redirected to FTP w/o auth
 + </name>
 + <command>
 +http://%HOSTIP:%HTTPPORT/973 -L -u joe:secret
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<strip>
 +^User-Agent:.*
 +</strip>
 +<protocol>
 +GET /973 HTTP/1.1
 +Host: %HOSTIP:%HTTPPORT
 +Authorization: Basic am9lOnNlY3JldA==
 +Accept: */*
 +
 +USER anonymous
 +PASS ftp@example.com
 +PWD
 +CWD a
 +CWD path
 +EPSV
 +TYPE I
 +SIZE 9730002
 +RETR 9730002
 +QUIT
 +</protocol>
 +</verify>
 +</testcase>
 diff --git a/tests/data/test974 b/tests/data/test974
 new file mode 100644
 index 0000000..de02d89
 --- /dev/null
 +++ b/tests/data/test974
@@ -0,0 +1,88 @@
 +<testcase>
 +<info>
 +<keywords>
 +HTTP
 +--location
 +</keywords>
 +</info>
 +
 +#
 +# Server-side
 +<reply>
 +<data>
 +HTTP/1.1 301 redirect
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
 +Location: http://firsthost.com:9999/a/path/9740002
 +
 +</data>
 +<data2>
 +HTTP/1.1 200 OK
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 4
 +Connection: close
 +Content-Type: text/html
 +
 +hey
 +</data2>
 +
 +<datacheck>
 +HTTP/1.1 301 redirect
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
 +Location: http://firsthost.com:9999/a/path/9740002
 +
 +HTTP/1.1 200 OK
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 4
 +Connection: close
 +Content-Type: text/html
 +
 +hey
 +</datacheck>
 +
 +</reply>
 +
 +#
 +# Client-side
 +<client>
 +<server>
 +http
 +</server>
 + <name>
 +HTTP with auth redirected to HTTP on a diff port w/o auth
 + </name>
 + <command>
 +-x http://%HOSTIP:%HTTPPORT http://firsthost.com -L -u joe:secret
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<strip>
 +^User-Agent:.*
 +</strip>
 +<protocol>
 +GET http://firsthost.com/ HTTP/1.1
 +Host: firsthost.com
 +Authorization: Basic am9lOnNlY3JldA==
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +
 +GET http://firsthost.com:9999/a/path/9740002 HTTP/1.1
 +Host: firsthost.com:9999
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +
 +</protocol>
 +</verify>
 +</testcase>
 diff --git a/tests/data/test975 b/tests/data/test975
 new file mode 100644
 index 0000000..3a4eccf
 --- /dev/null
 +++ b/tests/data/test975
@@ -0,0 +1,90 @@
 +<testcase>
 +<info>
 +<keywords>
 +HTTP
 +FTP
 +--location-trusted
 +</keywords>
 +</info>
 +
 +#
 +# Server-side
 +<reply>
 +<data>
 +HTTP/1.1 301 redirect
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
 +Location: ftp://127.0.0.1:8992/a/path/9750002
 +
 +</data>
 +<data2>
 +data
 +    to
 +      see
 +that FTP
 +works
 +  so does it?
 +</data2>
 +
 +<datacheck>
 +HTTP/1.1 301 redirect
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
 +Location: ftp://127.0.0.1:8992/a/path/9750002
 +
 +data
 +    to
 +      see
 +that FTP
 +works
 +  so does it?
 +</datacheck>
 +
 +</reply>
 +
 +#
 +# Client-side
 +<client>
 +<server>
 +http
 +ftp
 +</server>
 + <name>
 +HTTP with auth redirected to FTP allowing auth to continue
 + </name>
 + <command>
 +http://%HOSTIP:%HTTPPORT/975 --location-trusted -u joe:secret
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<strip>
 +^User-Agent:.*
 +</strip>
 +<protocol>
 +GET /975 HTTP/1.1
 +Host: %HOSTIP:%HTTPPORT
 +Authorization: Basic am9lOnNlY3JldA==
 +Accept: */*
 +
 +USER joe
 +PASS secret
 +PWD
 +CWD a
 +CWD path
 +EPSV
 +TYPE I
 +SIZE 9750002
 +RETR 9750002
 +QUIT
 +</protocol>
 +</verify>
 +</testcase>
 diff --git a/tests/data/test976 b/tests/data/test976
 new file mode 100644
 index 0000000..3b6fac7
 --- /dev/null
 +++ b/tests/data/test976
@@ -0,0 +1,89 @@
 +<testcase>
 +<info>
 +<keywords>
 +HTTP
 +--location-trusted
 +</keywords>
 +</info>
 +
 +#
 +# Server-side
 +<reply>
 +<data>
 +HTTP/1.1 301 redirect
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
 +Location: http://firsthost.com:9999/a/path/9760002
 +
 +</data>
 +<data2>
 +HTTP/1.1 200 OK
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 4
 +Connection: close
 +Content-Type: text/html
 +
 +hey
 +</data2>
 +
 +<datacheck>
 +HTTP/1.1 301 redirect
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 0
 +Connection: close
 +Content-Type: text/html
 +Location: http://firsthost.com:9999/a/path/9760002
 +
 +HTTP/1.1 200 OK
 +Date: Tue, 09 Nov 2010 14:49:00 GMT
 +Server: test-server/fake
 +Content-Length: 4
 +Connection: close
 +Content-Type: text/html
 +
 +hey
 +</datacheck>
 +
 +</reply>
 +
 +#
 +# Client-side
 +<client>
 +<server>
 +http
 +</server>
 + <name>
 +HTTP with auth redirected to HTTP on a diff port --location-trusted
 + </name>
 + <command>
 +-x http://%HOSTIP:%HTTPPORT http://firsthost.com --location-trusted -u joe:secret
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<strip>
 +^User-Agent:.*
 +</strip>
 +<protocol>
 +GET http://firsthost.com/ HTTP/1.1
 +Host: firsthost.com
 +Authorization: Basic am9lOnNlY3JldA==
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +
 +GET http://firsthost.com:9999/a/path/9760002 HTTP/1.1
 +Host: firsthost.com:9999
 +Authorization: Basic am9lOnNlY3JldA==
 +Accept: */*
 +Proxy-Connection: Keep-Alive
 +
 +</protocol>
 +</verify>
 +</testcase>
 -- 
 2.34.1
 From cf98bd64b9949c50d4726eb26745c2f7fdf3a075 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 25 Apr 2022 17:59:15 +0200
 Subject: [PATCH 4/4] openssl: don't leak the SRP credentials in redirects
 either
 Follow-up to 620ea21410030
 Reported-by: Harry Sintonen
 Closes #8751
 Upstream-commit: 139a54ed0a172adaaf1a78d6f4fff50b2c3f9e08
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/http.c         | 10 +++++-----
 lib/http.h         |  6 ++++++
 lib/vtls/openssl.c |  3 ++-
 3 files changed, 13 insertions(+), 6 deletions(-)
 diff --git a/lib/http.c b/lib/http.c
 index 39fc7aa..d413738 100644
 --- a/lib/http.c
 +++ b/lib/http.c
@@ -689,10 +689,10 @@ output_auth_headers(struct connectdata *conn,
 }
 /*
 - * allow_auth_to_host() tells if autentication, cookies or other "sensitive
 - * data" can (still) be sent to this host.
 + * Curl_allow_auth_to_host() tells if authentication, cookies or other
 + * "sensitive data" can (still) be sent to this host.
  */
 -static bool allow_auth_to_host(struct connectdata *conn)
 +bool Curl_allow_auth_to_host(struct connectdata *conn)
 {
   struct Curl_easy *data = conn->data;
   return (!data->state.this_is_a_follow ||
@@ -773,7 +773,7 @@ Curl_http_output_auth(struct connectdata *conn,
   /* To prevent the user+password to get sent to other than the original host
      due to a location-follow */
 -  if(allow_auth_to_host(conn)
 +  if(Curl_allow_auth_to_host(conn)
      || conn->bits.netrc)
     result = output_auth_headers(conn, authhost, request, path, FALSE);
   else
@@ -1789,7 +1789,7 @@ CURLcode Curl_add_custom_headers(struct connectdata *conn,
                    checkprefix("Cookie:", headers->data)) &&
                   /* be careful of sending this potentially sensitive header to
                      other hosts */
 -                  !allow_auth_to_host(conn))
 +                  !Curl_allow_auth_to_host(conn))
             ;
           else {
             result = Curl_add_bufferf(req_buffer, "%s\r\n", headers->data);
 diff --git a/lib/http.h b/lib/http.h
 index 1d373e8..56a6061 100644
 --- a/lib/http.h
 +++ b/lib/http.h
@@ -252,5 +252,11 @@ Curl_http_output_auth(struct connectdata *conn,
                       bool proxytunnel); /* TRUE if this is the request setting
                                             up the proxy tunnel */
 +/*
 + * Curl_allow_auth_to_host() tells if authentication, cookies or other
 + * "sensitive data" can (still) be sent to this host.
 + */
 +bool Curl_allow_auth_to_host(struct connectdata *conn);
 +
 #endif /* HEADER_CURL_HTTP_H */
 diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
 index 28eaa6d..6c8faa2 100644
 --- a/lib/vtls/openssl.c
 +++ b/lib/vtls/openssl.c
@@ -2499,7 +2499,8 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
 #endif
 #ifdef USE_TLS_SRP
 -  if(ssl_authtype == CURL_TLSAUTH_SRP) {
 +  if((ssl_authtype == CURL_TLSAUTH_SRP) &&
 +     Curl_allow_auth_to_host(conn)) {
     char * const ssl_username = SSL_SET_OPTION(username);
     infof(data, "Using TLS-SRP username: %s\n", ssl_username);
 -- 
 2.34.1
--- a/SOURCES/0039-curl-7.61.1-CVE-2022-27782.patch
+++ b/SOURCES/0039-curl-7.61.1-CVE-2022-27782.patch
@ -1,364 +0,0 @@
 From d4247fa7baf0859729fff2fe5cf0bfab8322d1a5 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 9 May 2022 23:13:53 +0200
 Subject: [PATCH 1/2] tls: check more TLS details for connection reuse
 CVE-2022-27782
 Reported-by: Harry Sintonen
 Bug: https://curl.se/docs/CVE-2022-27782.html
 Closes #8825
 Upstream-commit: f18af4f874cecab82a9797e8c7541e0990c7a64c
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/setopt.c       | 29 +++++++++++++++++------------
 lib/url.c          | 19 ++++++++++++-------
 lib/urldata.h      | 14 +++++++-------
 lib/vtls/openssl.c | 10 +++++-----
 lib/vtls/vtls.c    | 21 +++++++++++++++++++++
 5 files changed, 62 insertions(+), 31 deletions(-)
 diff --git a/lib/setopt.c b/lib/setopt.c
 index b07ccfe..319a010 100644
 --- a/lib/setopt.c
 +++ b/lib/setopt.c
@@ -2044,6 +2044,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
   case CURLOPT_SSL_OPTIONS:
     arg = va_arg(param, long);
 +    data->set.ssl.primary.ssl_options = (unsigned char)(arg & 0xff);
     data->set.ssl.enable_beast = arg&CURLSSLOPT_ALLOW_BEAST?TRUE:FALSE;
     data->set.ssl.no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE);
     data->set.ssl.no_partialchain = !!(arg & CURLSSLOPT_NO_PARTIALCHAIN);
@@ -2051,6 +2052,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
   case CURLOPT_PROXY_SSL_OPTIONS:
     arg = va_arg(param, long);
 +    data->set.proxy_ssl.primary.ssl_options = (unsigned char)(arg & 0xff);
     data->set.proxy_ssl.enable_beast = arg&CURLSSLOPT_ALLOW_BEAST?TRUE:FALSE;
     data->set.proxy_ssl.no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE);
     break;
@@ -2451,44 +2453,47 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
   case CURLOPT_TLSAUTH_USERNAME:
     result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_USERNAME],
                             va_arg(param, char *));
 -    if(data->set.str[STRING_TLSAUTH_USERNAME] && !data->set.ssl.authtype)
 -      data->set.ssl.authtype = CURL_TLSAUTH_SRP; /* default to SRP */
 +    if(data->set.str[STRING_TLSAUTH_USERNAME] &&
 +       !data->set.ssl.primary.authtype)
 +      data->set.ssl.primary.authtype = CURL_TLSAUTH_SRP; /* default to SRP */
     break;
   case CURLOPT_PROXY_TLSAUTH_USERNAME:
     result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_USERNAME_PROXY],
                             va_arg(param, char *));
     if(data->set.str[STRING_TLSAUTH_USERNAME_PROXY] &&
 -       !data->set.proxy_ssl.authtype)
 -      data->set.proxy_ssl.authtype = CURL_TLSAUTH_SRP; /* default to SRP */
 +       !data->set.proxy_ssl.primary.authtype)
 +      data->set.proxy_ssl.primary.authtype = CURL_TLSAUTH_SRP; /* default to
 +                                                                  SRP */
     break;
   case CURLOPT_TLSAUTH_PASSWORD:
     result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_PASSWORD],
                             va_arg(param, char *));
 -    if(data->set.str[STRING_TLSAUTH_USERNAME] && !data->set.ssl.authtype)
 -      data->set.ssl.authtype = CURL_TLSAUTH_SRP; /* default to SRP */
 +    if(data->set.str[STRING_TLSAUTH_USERNAME] &&
 +       !data->set.ssl.primary.authtype)
 +      data->set.ssl.primary.authtype = CURL_TLSAUTH_SRP; /* default */
     break;
   case CURLOPT_PROXY_TLSAUTH_PASSWORD:
     result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_PASSWORD_PROXY],
                             va_arg(param, char *));
     if(data->set.str[STRING_TLSAUTH_USERNAME_PROXY] &&
 -       !data->set.proxy_ssl.authtype)
 -      data->set.proxy_ssl.authtype = CURL_TLSAUTH_SRP; /* default to SRP */
 +       !data->set.proxy_ssl.primary.authtype)
 +      data->set.proxy_ssl.primary.authtype = CURL_TLSAUTH_SRP; /* default */
     break;
   case CURLOPT_TLSAUTH_TYPE:
     argptr = va_arg(param, char *);
     if(!argptr ||
        strncasecompare(argptr, "SRP", strlen("SRP")))
 -      data->set.ssl.authtype = CURL_TLSAUTH_SRP;
 +      data->set.ssl.primary.authtype = CURL_TLSAUTH_SRP;
     else
 -      data->set.ssl.authtype = CURL_TLSAUTH_NONE;
 +      data->set.ssl.primary.authtype = CURL_TLSAUTH_NONE;
     break;
   case CURLOPT_PROXY_TLSAUTH_TYPE:
     argptr = va_arg(param, char *);
     if(!argptr ||
        strncasecompare(argptr, "SRP", strlen("SRP")))
 -      data->set.proxy_ssl.authtype = CURL_TLSAUTH_SRP;
 +      data->set.proxy_ssl.primary.authtype = CURL_TLSAUTH_SRP;
     else
 -      data->set.proxy_ssl.authtype = CURL_TLSAUTH_NONE;
 +      data->set.proxy_ssl.primary.authtype = CURL_TLSAUTH_NONE;
     break;
 #endif
   case CURLOPT_DNS_SERVERS:
 diff --git a/lib/url.c b/lib/url.c
 index 7dd5267..30fc5ad 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -461,7 +461,7 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
   set->ssl.primary.verifypeer = TRUE;
   set->ssl.primary.verifyhost = TRUE;
 #ifdef USE_TLS_SRP
 -  set->ssl.authtype = CURL_TLSAUTH_NONE;
 +  set->ssl.primary.authtype = CURL_TLSAUTH_NONE;
 #endif
   set->ssh_auth_types = CURLSSH_AUTH_DEFAULT; /* defaults to any auth
                                                       type */
@@ -1881,10 +1881,12 @@ static struct connectdata *allocate_conn(struct Curl_easy *data)
   conn->ssl_config.verifystatus = data->set.ssl.primary.verifystatus;
   conn->ssl_config.verifypeer = data->set.ssl.primary.verifypeer;
   conn->ssl_config.verifyhost = data->set.ssl.primary.verifyhost;
 +  conn->ssl_config.ssl_options = data->set.ssl.primary.ssl_options;
   conn->proxy_ssl_config.verifystatus =
     data->set.proxy_ssl.primary.verifystatus;
   conn->proxy_ssl_config.verifypeer = data->set.proxy_ssl.primary.verifypeer;
   conn->proxy_ssl_config.verifyhost = data->set.proxy_ssl.primary.verifyhost;
 +  conn->proxy_ssl_config.ssl_options = data->set.proxy_ssl.primary.ssl_options;
   conn->ip_version = data->set.ipver;
@@ -4362,8 +4364,9 @@ static CURLcode create_conn(struct Curl_easy *data,
   data->set.proxy_ssl.primary.cipher_list13 =
     data->set.str[STRING_SSL_CIPHER13_LIST_PROXY];
 -  data->set.ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE];
 -  data->set.proxy_ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE_PROXY];
 +  data->set.ssl.primary.CRLfile = data->set.str[STRING_SSL_CRLFILE];
 +  data->set.proxy_ssl.primary.CRLfile =
 +    data->set.str[STRING_SSL_CRLFILE_PROXY];
   data->set.ssl.cert = data->set.str[STRING_CERT];
   data->set.proxy_ssl.cert = data->set.str[STRING_CERT_PROXY];
   data->set.ssl.cert_type = data->set.str[STRING_CERT_TYPE];
@@ -4377,10 +4380,12 @@ static CURLcode create_conn(struct Curl_easy *data,
   data->set.ssl.primary.clientcert = data->set.str[STRING_CERT];
   data->set.proxy_ssl.primary.clientcert = data->set.str[STRING_CERT_PROXY];
 #ifdef USE_TLS_SRP
 -  data->set.ssl.username = data->set.str[STRING_TLSAUTH_USERNAME];
 -  data->set.proxy_ssl.username = data->set.str[STRING_TLSAUTH_USERNAME_PROXY];
 -  data->set.ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD];
 -  data->set.proxy_ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD_PROXY];
 +  data->set.ssl.primary.username = data->set.str[STRING_TLSAUTH_USERNAME];
 +  data->set.ssl.primary.password = data->set.str[STRING_TLSAUTH_PASSWORD];
 +  data->set.proxy_ssl.primary.username =
 +    data->set.str[STRING_TLSAUTH_USERNAME_PROXY];
 +  data->set.proxy_ssl.primary.password =
 +    data->set.str[STRING_TLSAUTH_PASSWORD_PROXY];
 #endif
   if(!Curl_clone_primary_ssl_config(&data->set.ssl.primary,
 diff --git a/lib/urldata.h b/lib/urldata.h
 index 026684b..0e48841 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -229,6 +229,13 @@ struct ssl_primary_config {
   char *egdsocket;       /* path to file containing the EGD daemon socket */
   char *cipher_list;     /* list of ciphers to use */
   char *cipher_list13;   /* list of TLS 1.3 cipher suites to use */
 +  char *CRLfile;         /* CRL to check certificate revocation */
 +#ifdef USE_TLS_SRP
 +  char *username; /* TLS username (for, e.g., SRP) */
 +  char *password; /* TLS password (for, e.g., SRP) */
 +  enum CURL_TLSAUTH authtype; /* TLS authentication type (default SRP) */
 +#endif
 +  unsigned char ssl_options;  /* the CURLOPT_SSL_OPTIONS bitmask */
 };
 struct ssl_config_data {
@@ -238,7 +245,6 @@ struct ssl_config_data {
   bool no_revoke;    /* disable SSL certificate revocation checks */
   bool no_partialchain;  /* don't accept partial certificate chains */
   long certverifyresult; /* result from the certificate verification */
 -  char *CRLfile;   /* CRL to check certificate revocation */
   curl_ssl_ctx_callback fsslctx; /* function to initialize ssl ctx */
   void *fsslctxp;        /* parameter for call back */
   bool certinfo;         /* gather lots of certificate info */
@@ -249,12 +255,6 @@ struct ssl_config_data {
   char *key; /* private key file name */
   char *key_type; /* format for private key (default: PEM) */
   char *key_passwd; /* plain text private key password */
 -
 -#ifdef USE_TLS_SRP
 -  char *username; /* TLS username (for, e.g., SRP) */
 -  char *password; /* TLS password (for, e.g., SRP) */
 -  enum CURL_TLSAUTH authtype; /* TLS authentication type (default SRP) */
 -#endif
 };
 struct ssl_general_config {
 diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
 index 6c8faa2..75ff8d8 100644
 --- a/lib/vtls/openssl.c
 +++ b/lib/vtls/openssl.c
@@ -2232,14 +2232,14 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
     &data->set.proxy_ssl.certverifyresult : &data->set.ssl.certverifyresult;
   const long int ssl_version = SSL_CONN_CONFIG(version);
 #ifdef USE_TLS_SRP
 -  const enum CURL_TLSAUTH ssl_authtype = SSL_SET_OPTION(authtype);
 +  const enum CURL_TLSAUTH ssl_authtype = SSL_SET_OPTION(primary.authtype);
 #endif
   char * const ssl_cert = SSL_SET_OPTION(cert);
   const char * const ssl_cert_type = SSL_SET_OPTION(cert_type);
   const char * const ssl_cafile = SSL_CONN_CONFIG(CAfile);
   const char * const ssl_capath = SSL_CONN_CONFIG(CApath);
   const bool verifypeer = SSL_CONN_CONFIG(verifypeer);
 -  const char * const ssl_crlfile = SSL_SET_OPTION(CRLfile);
 +  const char * const ssl_crlfile = SSL_SET_OPTION(primary.CRLfile);
   char error_buffer[256];
   DEBUGASSERT(ssl_connect_1 == connssl->connecting_state);
@@ -2501,15 +2501,15 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
 #ifdef USE_TLS_SRP
   if((ssl_authtype == CURL_TLSAUTH_SRP) &&
      Curl_allow_auth_to_host(conn)) {
 -    char * const ssl_username = SSL_SET_OPTION(username);
 -
 +    char * const ssl_username = SSL_SET_OPTION(primary.username);
 +    char * const ssl_password = SSL_SET_OPTION(primary.password);
     infof(data, "Using TLS-SRP username: %s\n", ssl_username);
     if(!SSL_CTX_set_srp_username(BACKEND->ctx, ssl_username)) {
       failf(data, "Unable to set SRP user name");
       return CURLE_BAD_FUNCTION_ARGUMENT;
     }
 -    if(!SSL_CTX_set_srp_password(BACKEND->ctx, SSL_SET_OPTION(password))) {
 +    if(!SSL_CTX_set_srp_password(BACKEND->ctx, ssl_password)) {
       failf(data, "failed setting SRP password");
       return CURLE_BAD_FUNCTION_ARGUMENT;
     }
 diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
 index bdff93f..2b14fa6 100644
 --- a/lib/vtls/vtls.c
 +++ b/lib/vtls/vtls.c
@@ -88,6 +88,7 @@ Curl_ssl_config_matches(struct ssl_primary_config* data,
 {
   if((data->version == needle->version) &&
      (data->version_max == needle->version_max) &&
 +     (data->ssl_options == needle->ssl_options) &&
      (data->verifypeer == needle->verifypeer) &&
      (data->verifyhost == needle->verifyhost) &&
      (data->verifystatus == needle->verifystatus) &&
@@ -96,6 +97,12 @@ Curl_ssl_config_matches(struct ssl_primary_config* data,
      Curl_safecmp(data->clientcert, needle->clientcert) &&
      Curl_safecmp(data->random_file, needle->random_file) &&
      Curl_safecmp(data->egdsocket, needle->egdsocket) &&
 +#ifdef USE_TLS_SRP
 +     Curl_safecmp(data->username, needle->username) &&
 +     Curl_safecmp(data->password, needle->password) &&
 +     (data->authtype == needle->authtype) &&
 +#endif
 +     Curl_safe_strcasecompare(data->CRLfile, needle->CRLfile) &&
      Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) &&
      Curl_safe_strcasecompare(data->cipher_list13, needle->cipher_list13))
     return TRUE;
@@ -113,6 +120,10 @@ Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
   dest->verifyhost = source->verifyhost;
   dest->verifystatus = source->verifystatus;
   dest->sessionid = source->sessionid;
 +  dest->ssl_options = source->ssl_options;
 +#ifdef USE_TLS_SRP
 +  dest->authtype = source->authtype;
 +#endif
   CLONE_STRING(CApath);
   CLONE_STRING(CAfile);
@@ -122,6 +133,11 @@ Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
   CLONE_STRING(egdsocket);
   CLONE_STRING(cipher_list);
   CLONE_STRING(cipher_list13);
 +  CLONE_STRING(CRLfile);
 +#ifdef USE_TLS_SRP
 +  CLONE_STRING(username);
 +  CLONE_STRING(password);
 +#endif
   return TRUE;
 }
@@ -136,6 +152,11 @@ void Curl_free_primary_ssl_config(struct ssl_primary_config* sslc)
   Curl_safefree(sslc->egdsocket);
   Curl_safefree(sslc->cipher_list);
   Curl_safefree(sslc->cipher_list13);
 +  Curl_safefree(sslc->CRLfile);
 +#ifdef USE_TLS_SRP
 +  Curl_safefree(sslc->username);
 +  Curl_safefree(sslc->password);
 +#endif
 }
 #ifdef USE_SSL
 -- 
 2.34.1
 From a9cf46e6c6c9a4261f3ea8500dfef87c1436908b Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 9 May 2022 23:13:53 +0200
 Subject: [PATCH 2/2] url: check SSH config match on connection reuse
 CVE-2022-27782
 Reported-by: Harry Sintonen
 Bug: https://curl.se/docs/CVE-2022-27782.html
 Closes #8825
 Upstream-commit: 1645e9b44505abd5cbaf65da5282c3f33b5924a5
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/ssh.h |  4 ++--
 lib/url.c | 11 +++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)
 diff --git a/lib/ssh.h b/lib/ssh.h
 index 0620aac..1114f8a 100644
 --- a/lib/ssh.h
 +++ b/lib/ssh.h
@@ -117,8 +117,8 @@ struct ssh_conn {
   /* common */
   const char *passphrase;     /* pass-phrase to use */
 -  char *rsa_pub;              /* path name */
 -  char *rsa;                  /* path name */
 +  char *rsa_pub;              /* strdup'ed public key file */
 +  char *rsa;                  /* strdup'ed private key file */
   bool authed;                /* the connection has been authenticated fine */
   sshstate state;             /* always use ssh.c:state() to change state! */
   sshstate nextstate;         /* the state to goto after stopping */
 diff --git a/lib/url.c b/lib/url.c
 index 30fc5ad..8653ebb 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -1030,6 +1030,12 @@ static size_t max_pipeline_length(struct Curl_multi *multi)
 }
 +static bool ssh_config_matches(struct connectdata *one,
 +                               struct connectdata *two)
 +{
 +  return (Curl_safecmp(one->proto.sshc.rsa, two->proto.sshc.rsa) &&
 +          Curl_safecmp(one->proto.sshc.rsa_pub, two->proto.sshc.rsa_pub));
 +}
 /*
  * Given one filled in connection struct (named needle), this function should
  * detect if there already is one that has all the significant details
@@ -1299,6 +1305,11 @@ ConnectionExists(struct Curl_easy *data,
         }
       }
 +      if(needle->handler->protocol & (CURLPROTO_SCP|CURLPROTO_SFTP)) {
 +        if(!ssh_config_matches(needle, check))
 +          continue;
 +      }
 +
       if(!needle->bits.httpproxy || (needle->handler->flags&PROTOPT_SSL) ||
          needle->bits.tunnel_proxy) {
         /* The requested connection does not use a HTTP proxy or it uses SSL or
 -- 
 2.34.1
--- a/SOURCES/0040-curl-7.61.1-CVE-2022-32208.patch
+++ b/SOURCES/0040-curl-7.61.1-CVE-2022-32208.patch
@ -1,86 +0,0 @@
 From d36661703e16bd740a3a928041b1e697a6617b98 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 9 Jun 2022 09:27:24 +0200
 Subject: [PATCH] krb5: return error properly on decode errors
 Bug: https://curl.se/docs/CVE-2022-32208.html
 CVE-2022-32208
 Reported-by: Harry Sintonen
 Closes #9051
 Upstream-commit: 6ecdf5136b52af747e7bda08db9a748256b1cd09
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/krb5.c     |  5 +----
 lib/security.c | 19 +++++++++++++++----
 2 files changed, 16 insertions(+), 8 deletions(-)
 diff --git a/lib/krb5.c b/lib/krb5.c
 index 787137c..6f9e1f7 100644
 --- a/lib/krb5.c
 +++ b/lib/krb5.c
@@ -86,11 +86,8 @@ krb5_decode(void *app_data, void *buf, int len,
   enc.value = buf;
   enc.length = len;
   maj = gss_unwrap(&min, *context, &enc, &dec, NULL, NULL);
 -  if(maj != GSS_S_COMPLETE) {
 -    if(len >= 4)
 -      strcpy(buf, "599 ");
 +  if(maj != GSS_S_COMPLETE)
     return -1;
 -  }
   memcpy(buf, dec.value, dec.length);
   len = curlx_uztosi(dec.length);
 diff --git a/lib/security.c b/lib/security.c
 index 52cce97..c95f290 100644
 --- a/lib/security.c
 +++ b/lib/security.c
@@ -64,6 +64,10 @@
 /* The last #include file should be: */
 #include "memdebug.h"
 +/* Max string input length is a precaution against abuse and to detect junk
 +   input easier and better. */
 +#define CURL_MAX_INPUT_LENGTH 8000000
 +
 static const struct {
   enum protection_level level;
   const char *name;
@@ -192,6 +196,7 @@ static CURLcode read_data(struct connectdata *conn,
 {
   int len;
   CURLcode result;
 +  int nread;
   result = socket_read(fd, &len, sizeof(len));
   if(result)
@@ -200,7 +205,10 @@ static CURLcode read_data(struct connectdata *conn,
   if(len) {
     /* only realloc if there was a length */
     len = ntohl(len);
 -    buf->data = Curl_saferealloc(buf->data, len);
 +    if(len > CURL_MAX_INPUT_LENGTH)
 +      len = 0;
 +    else
 +      buf->data = Curl_saferealloc(buf->data, len);
   }
   if(!len || !buf->data)
     return CURLE_OUT_OF_MEMORY;
@@ -208,8 +216,11 @@ static CURLcode read_data(struct connectdata *conn,
   result = socket_read(fd, buf->data, len);
   if(result)
     return result;
 -  buf->size = conn->mech->decode(conn->app_data, buf->data, len,
 -                                 conn->data_prot, conn);
 +  nread = conn->mech->decode(conn->app_data, buf->data, len,
 +                             conn->data_prot, conn);
 +  if(nread < 0)
 +    return CURLE_RECV_ERROR;
 +  buf->size = (size_t)nread;
   buf->index = 0;
   return CURLE_OK;
 }
 -- 
 2.35.3
--- a/SOURCES/0041-curl-7.61.1-CVE-2022-32206.patch
+++ b/SOURCES/0041-curl-7.61.1-CVE-2022-32206.patch
@ -1,144 +0,0 @@
 From 24dedf9b260eebb7feae6fc273208b551fe54a79 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 16 May 2022 16:28:13 +0200
 Subject: [PATCH 1/2] content_encoding: return error on too many compression
 steps
 The max allowed steps is arbitrarily set to 5.
 Bug: https://curl.se/docs/CVE-2022-32206.html
 CVE-2022-32206
 Reported-by: Harry Sintonen
 Closes #9049
 Upstream-commit: 3a09fbb7f264c67c438d01a30669ce325aa508e2
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/content_encoding.c | 9 +++++++++
 1 file changed, 9 insertions(+)
 diff --git a/lib/content_encoding.c b/lib/content_encoding.c
 index c03637a..6f994b3 100644
 --- a/lib/content_encoding.c
 +++ b/lib/content_encoding.c
@@ -934,6 +934,9 @@ static const content_encoding *find_encoding(const char *name, size_t len)
   return NULL;
 }
 +/* allow no more than 5 "chained" compression steps */
 +#define MAX_ENCODE_STACK 5
 +
 /* Set-up the unencoding stack from the Content-Encoding header value.
  * See RFC 7231 section 3.1.2.2. */
 CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
@@ -941,6 +944,7 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
 {
   struct Curl_easy *data = conn->data;
   struct SingleRequest *k = &data->req;
 +  int counter = 0;
   do {
     const char *name;
@@ -975,6 +979,11 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
       if(!encoding)
         encoding = &error_encoding;  /* Defer error at stack use. */
 +      if(++counter >= MAX_ENCODE_STACK) {
 +        failf(data, "Reject response due to %u content encodings",
 +              counter);
 +        return CURLE_BAD_CONTENT_ENCODING;
 +      }
       /* Stack the unencoding stage. */
       writer = new_unencoding_writer(conn, encoding, k->writer_stack);
       if(!writer)
 -- 
 2.35.3
 From b3cd74f01871281f0989860e04c546d896f0e72f Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 16 May 2022 16:29:07 +0200
 Subject: [PATCH 2/2] test387: verify rejection of compression chain attack
 Upstream-commit: 7230b19a2e17a164f61f82e4e409a9777ea2421a
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/data/Makefile.inc |  1 +
 tests/data/test387      | 53 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 100644 tests/data/test387
 diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
 index 98d5516..9b5f4fb 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
@@ -61,6 +61,7 @@ test325 test326 test330 \
 test340 \
 \
 test350 test351 test352 test353 test354 \
 +test387 \
 test393 test394 test395 \
 \
 test400 test401 test402 test403 test404 test405 test406 test407 test408 \
 diff --git a/tests/data/test387 b/tests/data/test387
 new file mode 100644
 index 0000000..015ec25
 --- /dev/null
 +++ b/tests/data/test387
@@ -0,0 +1,53 @@
 +<testcase>
 +<info>
 +<keywords>
 +HTTP
 +gzip
 +</keywords>
 +</info>
 +
 +#
 +# Server-side
 +<reply>
 +<data nocheck="yes">
 +HTTP/1.1 200 OK
 +Transfer-Encoding: gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip
 +
 +-foo-
 +</data>
 +</reply>
 +
 +#
 +# Client-side
 +<client>
 +<server>
 +http
 +</server>
 + <name>
 +Response with overly long compression chain
 + </name>
 + <command>
 +http://%HOSTIP:%HTTPPORT/%TESTNUMBER -sS
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<protocol>
 +GET /%TESTNUMBER HTTP/1.1
 +Host: %HOSTIP:%HTTPPORT
 +User-Agent: curl/7.61.1
 +Accept: */*
 +
 +</protocol>
 +
 +# CURLE_BAD_CONTENT_ENCODING is 61
 +<errorcode>
 +61
 +</errorcode>
 +<stderr mode="text">
 +curl: (61) Reject response due to 5 content encodings
 +</stderr>
 +</verify>
 +</testcase>
 -- 
 2.35.3
--- a/SOURCES/0042-curl-7.61.1-ssh-known-hosts.patch
+++ b/SOURCES/0042-curl-7.61.1-ssh-known-hosts.patch
@ -1,43 +0,0 @@
 From 9ea407a0476d22cde575826c18b5aa56b57ac9b4 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Felix=20H=C3=A4dicke?= <felixhaedicke@web.de>
 Date: Wed, 23 Jan 2019 23:10:39 +0100
 Subject: [PATCH] setopt: enable CURLOPT_SSH_KNOWNHOSTS and
 CURLOPT_SSH_KEYFUNCTION for libssh
 CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION are supported for
 libssh as well. So accepting these options only when compiling with
 libssh2 is wrong here.
 Fixes #3493
 Closes #3494
 Upstream-commit: 3cbf731d9ec7146f9f1a6ac0fbd9af7fe358f5bb
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/setopt.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
 diff --git a/lib/setopt.c b/lib/setopt.c
 index b07ccfe..88a05ff 100644
 --- a/lib/setopt.c
 +++ b/lib/setopt.c
@@ -2208,7 +2208,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
     result = Curl_setstropt(&data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5],
                             va_arg(param, char *));
     break;
 -#ifdef HAVE_LIBSSH2_KNOWNHOST_API
 +
   case CURLOPT_SSH_KNOWNHOSTS:
     /*
      * Store the file name to read known hosts from.
@@ -2229,7 +2229,6 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
      */
     data->set.ssh_keyfunc_userp = va_arg(param, void *);
     break;
 -#endif /* HAVE_LIBSSH2_KNOWNHOST_API */
 #endif /* USE_LIBSSH2 */
   case CURLOPT_HTTP_TRANSFER_DECODING:
 -- 
 2.34.1
--- a/SOURCES/0043-curl-7.61.1-CVE-2022-35252.patch
+++ b/SOURCES/0043-curl-7.61.1-CVE-2022-35252.patch
@ -1,171 +0,0 @@
 From 005d3f387bc5c3b2ee94d0597b5e202644c825f5 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Wed, 31 Oct 2018 11:08:49 +0100
 Subject: [PATCH 1/3] runtests: use the local curl for verifying
 ... revert the mistaken change brought in commit 8440616f53.
 Reported-by: Alessandro Ghedini
 Bug: https://curl.haxx.se/mail/lib-2018-10/0118.html
 Closes #3198
 Upstream-commit: 8effa8c2b09906a2f00a3f08322dc5da35245b0a
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/runtests.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/tests/runtests.pl b/tests/runtests.pl
 index 8d8ed81..d62fa40 100755
 --- a/tests/runtests.pl
 +++ b/tests/runtests.pl
@@ -152,7 +152,7 @@ my $NEGTELNETPORT;       # TELNET server port with negotiation
 my $srcdir = $ENV{'srcdir'} || '.';
 my $CURL="../src/curl".exe_ext(); # what curl executable to run on the tests
 -my $VCURL="curl";   # what curl binary to use to verify the servers with
 +my $VCURL=$CURL;   # what curl binary to use to verify the servers with
                    # VCURL is handy to set to the system one when the one you
                    # just built hangs or crashes and thus prevent verification
 my $DBGCURL=$CURL; #"../src/.libs/curl";  # alternative for debugging
 -- 
 2.37.3
 From fbc2ac6f06ec13cc872ce7adb870f4d7c7d5dded Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 29 Aug 2022 00:09:17 +0200
 Subject: [PATCH 2/3] cookie: reject cookies with "control bytes"
 Rejects 0x01 - 0x1f (except 0x09) plus 0x7f
 Reported-by: Axel Chong
 Bug: https://curl.se/docs/CVE-2022-35252.html
 CVE-2022-35252
 Closes #9381
 Upstream-commit: 8dfc93e573ca740544a2d79ebb0ed786592c65c3
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/cookie.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 diff --git a/lib/cookie.c b/lib/cookie.c
 index cb0c03b..e0470a1 100644
 --- a/lib/cookie.c
 +++ b/lib/cookie.c
@@ -371,6 +371,30 @@ static void strstore(char **str, const char *newstr)
   *str = strdup(newstr);
 }
 +/*
 +  RFC 6265 section 4.1.1 says a server should accept this range:
 +
 +  cookie-octet    = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
 +
 +  But Firefox and Chrome as of June 2022 accept space, comma and double-quotes
 +  fine. The prime reason for filtering out control bytes is that some HTTP
 +  servers return 400 for requests that contain such.
 +*/
 +static int invalid_octets(const char *p)
 +{
 +  /* Reject all bytes \x01 - \x1f (*except* \x09, TAB) + \x7f */
 +  static const char badoctets[] = {
 +    "\x01\x02\x03\x04\x05\x06\x07\x08\x0a"
 +    "\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14"
 +    "\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x7f"
 +  };
 +  size_t vlen, len;
 +  /* scan for all the octets that are *not* in cookie-octet */
 +  len = strcspn(p, badoctets);
 +  vlen = strlen(p);
 +  return (len != vlen);
 +}
 +
 /*
  * remove_expired() removes expired cookies.
  */
@@ -541,6 +565,11 @@ Curl_cookie_add(struct Curl_easy *data,
             badcookie = TRUE;
             break;
           }
 +          if(invalid_octets(whatptr) || invalid_octets(name)) {
 +            infof(data, "invalid octets in name/value, cookie dropped");
 +            badcookie = TRUE;
 +            break;
 +          }
         }
         else if(!len) {
           /* this was a "<name>=" with no content, and we must allow
 -- 
 2.37.1
 From 1a3e2bd48572761236934651091c899a4d460ef5 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 29 Aug 2022 00:09:17 +0200
 Subject: [PATCH 3/3] test8: verify that "ctrl-byte cookies" are ignored
 Upstream-commit: 2fc031d834d488854ffc58bf7dbcef7fa7c1fc28
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/data/test8 | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)
 diff --git a/tests/data/test8 b/tests/data/test8
 index a8548e6..8587611 100644
 --- a/tests/data/test8
 +++ b/tests/data/test8
@@ -46,6 +46,36 @@ Set-Cookie: trailingspace    = removed; path=/we/want;
 Set-Cookie: nocookie=yes; path=/WE;
 Set-Cookie: blexp=yesyes; domain=%HOSTIP; domain=%HOSTIP; expiry=totally bad;
 Set-Cookie: partialip=nono; domain=.0.0.1;
 +Set-Cookie: cookie1=-junk
 +Set-Cookie: cookie2=-junk
 +Set-Cookie: cookie3=-junk
 +Set-Cookie: cookie4=-junk
 +Set-Cookie: cookie5=-junk
 +Set-Cookie: cookie6=-junk
 +Set-Cookie: cookie7=-junk
 +Set-Cookie: cookie8=-junk
 +Set-Cookie: cookie9=junk-	-
 +Set-Cookie: cookie11=-junk
 +Set-Cookie: cookie12=-junk
 +Set-Cookie: cookie14=-junk
 +Set-Cookie: cookie15=-junk
 +Set-Cookie: cookie16=-junk
 +Set-Cookie: cookie17=-junk
 +Set-Cookie: cookie18=-junk
 +Set-Cookie: cookie19=-junk
 +Set-Cookie: cookie20=-junk
 +Set-Cookie: cookie21=-junk
 +Set-Cookie: cookie22=-junk
 +Set-Cookie: cookie23=-junk
 +Set-Cookie: cookie24=-junk
 +Set-Cookie: cookie25=-junk
 +Set-Cookie: cookie26=-junk
 +Set-Cookie: cookie27=-junk
 +Set-Cookie: cookie28=-junk
 +Set-Cookie: cookie29=-junk
 +Set-Cookie: cookie30=-junk
 +Set-Cookie: cookie31=-junk
 +Set-Cookie: cookie31=-junk
 </file>
 <precheck>
@@ -62,7 +92,7 @@ perl -e 'if ("%HOSTIP" !~ /\.0\.0\.1$/) {print "Test only works for HOSTIPs endi
 GET /we/want/8 HTTP/1.1
 Host: %HOSTIP:%HTTPPORT
 Accept: */*
 -Cookie: name with space=is weird but; trailingspace=removed; cookie=perhaps; cookie=yes; foobar=name; blexp=yesyes
 +Cookie: name with space=is weird but; trailingspace=removed; cookie=perhaps; cookie=yes; foobar=name; blexp=yesyes; cookie9=junk-	-
 </protocol>
 </verify>
 -- 
 2.37.1
--- a/SOURCES/0044-curl-7.61.1-retry-http11.patch
+++ b/SOURCES/0044-curl-7.61.1-retry-http11.patch
@ -1,112 +0,0 @@
 From 78b62ef1206621e8f4f1628ad4eb0a7be877c96f Mon Sep 17 00:00:00 2001
 From: Johannes Schindelin <johannes.schindelin@gmx.de>
 Date: Fri, 7 Dec 2018 17:04:39 +0100
 Subject: [PATCH] Upon HTTP_1_1_REQUIRED, retry the request with HTTP/1.1
 This is a companion patch to cbea2fd2c (NTLM: force the connection to
 HTTP/1.1, 2018-12-06): with NTLM, we can switch to HTTP/1.1
 preemptively. However, with other (Negotiate) authentication it is not
 clear to this developer whether there is a way to make it work with
 HTTP/2, so let's try HTTP/2 first and fall back in case we encounter the
 error HTTP_1_1_REQUIRED.
 Note: we will still keep the NTLM workaround, as it avoids an extra
 round trip.
 Daniel Stenberg helped a lot with this patch, in particular by
 suggesting to introduce the Curl_h2_http_1_1_error() function.
 Closes #3349
 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
 Upstream-commit: d997aa0e963c5be5de100dccdc5208d39bd3d62b
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/http2.c |  8 ++++++++
 lib/http2.h |  4 ++++
 lib/multi.c | 20 ++++++++++++++++++++
 3 files changed, 32 insertions(+)
 diff --git a/lib/http2.c b/lib/http2.c
 index d769193..3071097 100644
 --- a/lib/http2.c
 +++ b/lib/http2.c
@@ -2300,6 +2300,14 @@ void Curl_http2_cleanup_dependencies(struct Curl_easy *data)
     Curl_http2_remove_child(data->set.stream_depends_on, data);
 }
 +/* Only call this function for a transfer that already got a HTTP/2
 +   CURLE_HTTP2_STREAM error! */
 +bool Curl_h2_http_1_1_error(struct connectdata *conn)
 +{
 +  struct http_conn *httpc = &conn->proto.httpc;
 +  return (httpc->error_code == NGHTTP2_HTTP_1_1_REQUIRED);
 +}
 +
 #else /* !USE_NGHTTP2 */
 /* Satisfy external references even if http2 is not compiled in. */
 diff --git a/lib/http2.h b/lib/http2.h
 index 21cd9b8..91e504c 100644
 --- a/lib/http2.h
 +++ b/lib/http2.h
@@ -59,6 +59,9 @@ CURLcode Curl_http2_add_child(struct Curl_easy *parent,
 void Curl_http2_remove_child(struct Curl_easy *parent,
                              struct Curl_easy *child);
 void Curl_http2_cleanup_dependencies(struct Curl_easy *data);
 +
 +/* returns true if the HTTP/2 stream error was HTTP_1_1_REQUIRED */
 +bool Curl_h2_http_1_1_error(struct connectdata *conn);
 #else /* USE_NGHTTP2 */
 #define Curl_http2_init(x) CURLE_UNSUPPORTED_PROTOCOL
 #define Curl_http2_send_request(x) CURLE_UNSUPPORTED_PROTOCOL
@@ -74,6 +77,7 @@ void Curl_http2_cleanup_dependencies(struct Curl_easy *data);
 #define Curl_http2_add_child(x, y, z)
 #define Curl_http2_remove_child(x, y)
 #define Curl_http2_cleanup_dependencies(x)
 +#define Curl_h2_http_1_1_error(x) 0
 #endif
 #endif /* HEADER_CURL_HTTP2_H */
 diff --git a/lib/multi.c b/lib/multi.c
 index 0f57fd5..d64ba94 100644
 --- a/lib/multi.c
 +++ b/lib/multi.c
@@ -46,6 +46,7 @@
 #include "vtls/vtls.h"
 #include "connect.h"
 #include "http_proxy.h"
 +#include "http2.h"
 /* The last 3 #include files should be in this order */
 #include "curl_printf.h"
 #include "curl_memory.h"
@@ -1943,6 +1944,25 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
           done = TRUE;
         }
       }
 +      else if((CURLE_HTTP2_STREAM == result) &&
 +                Curl_h2_http_1_1_error(data->easy_conn)) {
 +        CURLcode ret = Curl_retry_request(data->easy_conn, &newurl);
 +
 +        infof(data, "Forcing HTTP/1.1 for NTLM");
 +        data->set.httpversion = CURL_HTTP_VERSION_1_1;
 +
 +        if(!ret)
 +          retry = (newurl)?TRUE:FALSE;
 +        else
 +          result = ret;
 +
 +        if(retry) {
 +          /* if we are to retry, set the result to OK and consider the
 +             request as done */
 +          result = CURLE_OK;
 +          done = TRUE;
 +        }
 +      }
       if(result) {
         /*
 -- 
 2.37.3
--- a/SOURCES/0045-curl-7.61.1-CVE-2022-43552.patch
+++ b/SOURCES/0045-curl-7.61.1-CVE-2022-43552.patch
@ -1,81 +0,0 @@
 From 5cdcf1dbd39c64e18a81fc912a36942a3ec87565 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 19 Dec 2022 08:38:37 +0100
 Subject: [PATCH] smb/telnet: do not free the protocol struct in *_done()
 It is managed by the generic layer.
 Reported-by: Trail of Bits
 Closes #10112
 Upstream-commit: 4f20188ac644afe174be6005ef4f6ffba232b8b2
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/smb.c    | 14 ++------------
 lib/telnet.c |  3 ---
 2 files changed, 2 insertions(+), 15 deletions(-)
 diff --git a/lib/smb.c b/lib/smb.c
 index 039d680..f682c1f 100644
 --- a/lib/smb.c
 +++ b/lib/smb.c
@@ -61,8 +61,6 @@ static CURLcode smb_connect(struct connectdata *conn, bool *done);
 static CURLcode smb_connection_state(struct connectdata *conn, bool *done);
 static CURLcode smb_do(struct connectdata *conn, bool *done);
 static CURLcode smb_request_state(struct connectdata *conn, bool *done);
 -static CURLcode smb_done(struct connectdata *conn, CURLcode status,
 -                         bool premature);
 static CURLcode smb_disconnect(struct connectdata *conn, bool dead);
 static int smb_getsock(struct connectdata *conn, curl_socket_t *socks,
                        int numsocks);
@@ -75,7 +73,7 @@ const struct Curl_handler Curl_handler_smb = {
   "SMB",                                /* scheme */
   smb_setup_connection,                 /* setup_connection */
   smb_do,                               /* do_it */
 -  smb_done,                             /* done */
 +  ZERO_NULL,                            /* done */
   ZERO_NULL,                            /* do_more */
   smb_connect,                          /* connect_it */
   smb_connection_state,                 /* connecting */
@@ -100,7 +98,7 @@ const struct Curl_handler Curl_handler_smbs = {
   "SMBS",                               /* scheme */
   smb_setup_connection,                 /* setup_connection */
   smb_do,                               /* do_it */
 -  smb_done,                             /* done */
 +  ZERO_NULL,                            /* done */
   ZERO_NULL,                            /* do_more */
   smb_connect,                          /* connect_it */
   smb_connection_state,                 /* connecting */
@@ -915,14 +913,6 @@ static CURLcode smb_request_state(struct connectdata *conn, bool *done)
   return CURLE_OK;
 }
 -static CURLcode smb_done(struct connectdata *conn, CURLcode status,
 -                         bool premature)
 -{
 -  (void) premature;
 -  Curl_safefree(conn->data->req.protop);
 -  return status;
 -}
 -
 static CURLcode smb_disconnect(struct connectdata *conn, bool dead)
 {
   struct smb_conn *smbc = &conn->proto.smbc;
 diff --git a/lib/telnet.c b/lib/telnet.c
 index 923c7f8..48cd0d7 100644
 --- a/lib/telnet.c
 +++ b/lib/telnet.c
@@ -1294,9 +1294,6 @@ static CURLcode telnet_done(struct connectdata *conn,
   curl_slist_free_all(tn->telnet_vars);
   tn->telnet_vars = NULL;
 -
 -  Curl_safefree(conn->data->req.protop);
 -
   return CURLE_OK;
 }
 -- 
 2.38.1
--- a/SOURCES/0046-curl-7.61.1-h2-window-size.patch
+++ b/SOURCES/0046-curl-7.61.1-h2-window-size.patch
@ -1,44 +0,0 @@
 From 4bbd1947aeb26d5dbcddbb058652e0e64771b71d Mon Sep 17 00:00:00 2001
 From: Kamil Dudka <kdudka@redhat.com>
 Date: Mon, 6 Feb 2023 17:46:36 +0100
 Subject: [PATCH] h2: lower initial window size to 32 MiB
 Cherry-picked from upstream commit
 15f51474c837679c0b79825c23356ac681ffabde which was focused on paused
 transfers but required an update of nghttp2 to work properly.
 Bug: https://bugzilla.redhat.com/2166254
 ---
 lib/http2.c         | 2 +-
 tests/data/test1800 | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 diff --git a/lib/http2.c b/lib/http2.c
 index 3071097..1fd2233 100644
 --- a/lib/http2.c
 +++ b/lib/http2.c
@@ -63,7 +63,7 @@
 #define NGHTTP2_HAS_SET_LOCAL_WINDOW_SIZE 1
 #endif
 -#define HTTP2_HUGE_WINDOW_SIZE (1 << 30)
 +#define HTTP2_HUGE_WINDOW_SIZE (32 * 1024 * 1024) /* 32 MB */
 #ifdef DEBUG_HTTP2
 #define H2BUGF(x) x
 diff --git a/tests/data/test1800 b/tests/data/test1800
 index 0110184..c308c99 100644
 --- a/tests/data/test1800
 +++ b/tests/data/test1800
@@ -48,7 +48,7 @@ Host: %HOSTIP:%HTTPPORT
 Accept: */*
 Connection: Upgrade, HTTP2-Settings
 Upgrade: %H2CVER
 -HTTP2-Settings: AAMAAABkAARAAAAAAAIAAAAA
 +HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA
 </protocol>
 </verify>
 -- 
 2.39.1
--- a/SOURCES/0047-curl-7.61.1-CVE-2023-23916.patch
+++ b/SOURCES/0047-curl-7.61.1-CVE-2023-23916.patch
@ -1,331 +0,0 @@
 From 95f873ff983a1ae57415b3c16a881e74432cf8b8 Mon Sep 17 00:00:00 2001
 From: Fabian Keil <fk@fabiankeil.de>
 Date: Tue, 9 Feb 2021 14:04:32 +0100
 Subject: [PATCH 1/2] runtests.pl: support the nonewline attribute for the data
 part
 Closes #8239
 Upstream-commit: 736847611a40c01e7c290407e22e2f0f5f8efd6a
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 tests/runtests.pl      |  7 +++++++
 tests/server/getpart.c | 11 ++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)
 diff --git a/tests/runtests.pl b/tests/runtests.pl
 index 40315aa..2e1500d 100755
 --- a/tests/runtests.pl
 +++ b/tests/runtests.pl
@@ -3817,6 +3817,13 @@ sub singletest {
     else {
         # check against the data section
         @reply = getpart("reply", "data");
 +        if(@reply) {
 +            my %hash = getpartattr("reply", "data");
 +            if($hash{'nonewline'}) {
 +                # cut off the final newline from the final line of the data
 +                chomp($reply[$#reply]);
 +            }
 +        }
         # get the mode attribute
         my $filemode=$replyattr{'mode'};
         if($filemode && ($filemode eq "text") && $has_textaware) {
 diff --git a/tests/server/getpart.c b/tests/server/getpart.c
 index 32b55bc..f8fe3f6 100644
 --- a/tests/server/getpart.c
 +++ b/tests/server/getpart.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
 - * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
 + * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -295,6 +295,7 @@ int getpart(char **outbuf, size_t *outlen,
   size_t outalloc = 256;
   int in_wanted_part = 0;
   int base64 = 0;
 +  int nonewline = 0;
   int error;
   enum {
@@ -360,6 +361,8 @@ int getpart(char **outbuf, size_t *outlen,
             if(error)
               return error;
           }
 +          if(nonewline)
 +            (*outlen)--;
           break;
         }
       }
@@ -377,6 +380,8 @@ int getpart(char **outbuf, size_t *outlen,
             if(error)
               return error;
           }
 +          if(nonewline)
 +            (*outlen)--;
           break;
         }
       }
@@ -451,6 +456,10 @@ int getpart(char **outbuf, size_t *outlen,
               /* bit rough test, but "mostly" functional, */
               /* treat wanted part data as base64 encoded */
               base64 = 1;
 +          if(strstr(patt, "nonewline=")) {
 +            show(("* setting nonewline\n"));
 +            nonewline = 1;
 +          }
         }
         continue;
       }
 -- 
 2.39.1
 From bc5fc958b017895728962c9d44c469418cbec1a0 Mon Sep 17 00:00:00 2001
 From: Patrick Monnerat <patrick@monnerat.net>
 Date: Mon, 13 Feb 2023 08:33:09 +0100
 Subject: [PATCH 2/2] content_encoding: do not reset stage counter for each
 header
 Test 418 verifies
 Closes #10492
 Upstream-commit: 119fb187192a9ea13dc90d9d20c215fc82799ab9
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/content_encoding.c  |   7 +-
 lib/urldata.h           |   1 +
 tests/data/Makefile.inc |   1 +
 tests/data/test387      |   2 +-
 tests/data/test418      | 152 ++++++++++++++++++++++++++++++++++++++++
 5 files changed, 158 insertions(+), 5 deletions(-)
 create mode 100644 tests/data/test418
 diff --git a/lib/content_encoding.c b/lib/content_encoding.c
 index bfc13e2..94344d6 100644
 --- a/lib/content_encoding.c
 +++ b/lib/content_encoding.c
@@ -944,7 +944,6 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
 {
   struct Curl_easy *data = conn->data;
   struct SingleRequest *k = &data->req;
 -  int counter = 0;
   do {
     const char *name;
@@ -979,9 +978,9 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
       if(!encoding)
         encoding = &error_encoding;  /* Defer error at stack use. */
 -      if(++counter >= MAX_ENCODE_STACK) {
 -        failf(data, "Reject response due to %u content encodings",
 -              counter);
 +      if(k->writer_stack_depth++ >= MAX_ENCODE_STACK) {
 +        failf(data, "Reject response due to more than %u content encodings",
 +              MAX_ENCODE_STACK);
         return CURLE_BAD_CONTENT_ENCODING;
       }
       /* Stack the unencoding stage. */
 diff --git a/lib/urldata.h b/lib/urldata.h
 index 5b4b34f..8c8c20b 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -539,6 +539,7 @@ struct SingleRequest {
   struct curltime start;         /* transfer started at this time */
   struct curltime now;           /* current time */
 +  unsigned char writer_stack_depth; /* Unencoding stack depth. */
   bool header;                  /* incoming data has HTTP header */
   enum {
     HEADER_NORMAL,              /* no bad header at all */
 diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
 index fb51cd6..86b6f85 100644
 --- a/tests/data/Makefile.inc
 +++ b/tests/data/Makefile.inc
@@ -66,6 +66,7 @@ test393 test394 test395 \
 \
 test400 test401 test402 test403 test404 test405 test406 test407 test408 \
 test409 \
 +test418 \
 \
 test500 test501 test502 test503 test504 test505 test506 test507 test508 \
 test509 test510 test511 test512 test513 test514 test515 test516 test517 \
 diff --git a/tests/data/test387 b/tests/data/test387
 index 015ec25..644fc7f 100644
 --- a/tests/data/test387
 +++ b/tests/data/test387
@@ -47,7 +47,7 @@ Accept: */*
 61
 </errorcode>
 <stderr mode="text">
 -curl: (61) Reject response due to 5 content encodings
 +curl: (61) Reject response due to more than 5 content encodings
 </stderr>
 </verify>
 </testcase>
 diff --git a/tests/data/test418 b/tests/data/test418
 new file mode 100644
 index 0000000..50e974e
 --- /dev/null
 +++ b/tests/data/test418
@@ -0,0 +1,152 @@
 +<testcase>
 +<info>
 +<keywords>
 +HTTP
 +gzip
 +</keywords>
 +</info>
 +
 +#
 +# Server-side
 +<reply>
 +<data nocheck="yes">
 +HTTP/1.1 200 OK
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +Transfer-Encoding: gzip
 +
 +-foo-
 +</data>
 +</reply>
 +
 +#
 +# Client-side
 +<client>
 +<server>
 +http
 +</server>
 + <name>
 +Response with multiple Transfer-Encoding headers
 + </name>
 + <command>
 +http://%HOSTIP:%HTTPPORT/%TESTNUMBER -sS
 +</command>
 +</client>
 +
 +#
 +# Verify data after the test has been "shot"
 +<verify>
 +<protocol>
 +GET /%TESTNUMBER HTTP/1.1
 +Host: %HOSTIP:%HTTPPORT
 +User-Agent: curl/7.61.1
 +Accept: */*
 +
 +</protocol>
 +
 +# CURLE_BAD_CONTENT_ENCODING is 61
 +<errorcode>
 +61
 +</errorcode>
 +<stderr mode="text">
 +curl: (61) Reject response due to more than 5 content encodings
 +</stderr>
 +</verify>
 +</testcase>
 -- 
 2.39.1
--- a/SOURCES/0048-curl-7.61.1-CVE-2023-27535.patch
+++ b/SOURCES/0048-curl-7.61.1-CVE-2023-27535.patch
@ -1,231 +0,0 @@
 From e8705acd69383c13191c9dd4867d5118e58c54ba Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 6 Oct 2022 00:49:10 +0200
 Subject: [PATCH 1/2] strcase: add Curl_timestrcmp
 This is a strcmp() alternative function for comparing "secrets",
 designed to take the same time no matter the content to not leak
 match/non-match info to observers based on how fast it is.
 The time this function takes is only a function of the shortest input
 string.
 Reported-by: Trail of Bits
 Closes #9658
 Upstream-commit: ed5095ed94281989e103c72e032200b83be37878
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/strcase.c | 22 ++++++++++++++++++++++
 lib/strcase.h |  1 +
 2 files changed, 23 insertions(+)
 diff --git a/lib/strcase.c b/lib/strcase.c
 index f932485..c73907d 100644
 --- a/lib/strcase.c
 +++ b/lib/strcase.c
@@ -175,6 +175,28 @@ bool Curl_safecmp(char *a, char *b)
   return !a && !b;
 }
 +/*
 + * Curl_timestrcmp() returns 0 if the two strings are identical. The time this
 + * function spends is a function of the shortest string, not of the contents.
 + */
 +int Curl_timestrcmp(const char *a, const char *b)
 +{
 +  int match = 0;
 +  int i = 0;
 +
 +  if(a && b) {
 +    while(1) {
 +      match |= a[i]^b[i];
 +      if(!a[i] || !b[i])
 +        break;
 +      i++;
 +    }
 +  }
 +  else
 +    return a || b;
 +  return match;
 +}
 +
 /* --- public functions --- */
 int curl_strequal(const char *first, const char *second)
 diff --git a/lib/strcase.h b/lib/strcase.h
 index d245929..11a67a1 100644
 --- a/lib/strcase.h
 +++ b/lib/strcase.h
@@ -48,5 +48,6 @@ char Curl_raw_toupper(char in);
 void Curl_strntoupper(char *dest, const char *src, size_t n);
 bool Curl_safecmp(char *a, char *b);
 +int Curl_timestrcmp(const char *first, const char *second);
 #endif /* HEADER_CURL_STRCASE_H */
 -- 
 2.39.2
 From 9cfaea212ff347937a38f6b5d6b885ed8ba1b931 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 9 Mar 2023 17:47:06 +0100
 Subject: [PATCH 2/2] ftp: add more conditions for connection reuse
 Reported-by: Harry Sintonen
 Closes #10730
 Upstream-commit: 8f4608468b890dce2dad9f91d5607ee7e9c1aba1
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/ftp.c     | 28 ++++++++++++++++++++++++++--
 lib/ftp.h     |  5 +++++
 lib/setopt.c  |  2 +-
 lib/url.c     | 13 ++++++++++++-
 lib/urldata.h |  4 ++--
 5 files changed, 46 insertions(+), 6 deletions(-)
 diff --git a/lib/ftp.c b/lib/ftp.c
 index 9442832..df15bc0 100644
 --- a/lib/ftp.c
 +++ b/lib/ftp.c
@@ -4080,6 +4080,8 @@ static CURLcode ftp_disconnect(struct connectdata *conn, bool dead_connection)
   }
   freedirs(ftpc);
 +  Curl_safefree(ftpc->account);
 +  Curl_safefree(ftpc->alternative_to_user);
   free(ftpc->prevpath);
   ftpc->prevpath = NULL;
   free(ftpc->server_os);
@@ -4391,11 +4393,31 @@ static CURLcode ftp_setup_connection(struct connectdata *conn)
   struct Curl_easy *data = conn->data;
   char *type;
   struct FTP *ftp;
 +  struct ftp_conn *ftpc = &conn->proto.ftpc;
 -  conn->data->req.protop = ftp = malloc(sizeof(struct FTP));
 +  ftp = calloc(sizeof(struct FTP), 1);
   if(NULL == ftp)
     return CURLE_OUT_OF_MEMORY;
 +  /* clone connection related data that is FTP specific */
 +  if(data->set.str[STRING_FTP_ACCOUNT]) {
 +    ftpc->account = strdup(data->set.str[STRING_FTP_ACCOUNT]);
 +    if(!ftpc->account) {
 +      free(ftp);
 +      return CURLE_OUT_OF_MEMORY;
 +    }
 +  }
 +  if(data->set.str[STRING_FTP_ALTERNATIVE_TO_USER]) {
 +    ftpc->alternative_to_user =
 +      strdup(data->set.str[STRING_FTP_ALTERNATIVE_TO_USER]);
 +    if(!ftpc->alternative_to_user) {
 +      Curl_safefree(ftpc->account);
 +      free(ftp);
 +      return CURLE_OUT_OF_MEMORY;
 +    }
 +  }
 +  data->req.protop = ftp;
 +
   data->state.path++;   /* don't include the initial slash */
   data->state.slash_removed = TRUE; /* we've skipped the slash */
@@ -4445,7 +4467,9 @@ static CURLcode ftp_setup_connection(struct connectdata *conn)
   if(isBadFtpString(ftp->passwd))
     return CURLE_URL_MALFORMAT;
 -  conn->proto.ftpc.known_filesize = -1; /* unknown size for now */
 +  ftpc->known_filesize = -1; /* unknown size for now */
 +  ftpc->use_ssl = data->set.use_ssl;
 +  ftpc->ccc = data->set.ftp_ccc;
   return CURLE_OK;
 }
 diff --git a/lib/ftp.h b/lib/ftp.h
 index 7f6f432..3f33e27 100644
 --- a/lib/ftp.h
 +++ b/lib/ftp.h
@@ -117,6 +117,8 @@ struct FTP {
    struct */
 struct ftp_conn {
   struct pingpong pp;
 +  char *account;
 +  char *alternative_to_user;
   char *entrypath; /* the PWD reply when we logged on */
   char **dirs;   /* realloc()ed array for path components */
   int dirdepth;  /* number of entries used in the 'dirs' array */
@@ -144,6 +146,9 @@ struct ftp_conn {
   ftpstate state; /* always use ftp.c:state() to change state! */
   ftpstate state_saved; /* transfer type saved to be reloaded after
                            data connection is established */
 +  unsigned char use_ssl;   /* if AUTH TLS is to be attempted etc, for FTP or
 +                              IMAP or POP3 or others! (type: curl_usessl)*/
 +  unsigned char ccc;       /* ccc level for this connection */
   curl_off_t retr_size_saved; /* Size of retrieved file saved */
   char *server_os;     /* The target server operating system. */
   curl_off_t known_filesize; /* file size is different from -1, if wildcard
 diff --git a/lib/setopt.c b/lib/setopt.c
 index 3339a67..6fc111d 100644
 --- a/lib/setopt.c
 +++ b/lib/setopt.c
@@ -2039,7 +2039,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
     arg = va_arg(param, long);
     if((arg < CURLUSESSL_NONE) || (arg > CURLUSESSL_ALL))
       return CURLE_BAD_FUNCTION_ARGUMENT;
 -    data->set.use_ssl = (curl_usessl)arg;
 +    data->set.use_ssl = (unsigned char)arg;
     break;
   case CURLOPT_SSL_OPTIONS:
 diff --git a/lib/url.c b/lib/url.c
 index 61ba832..4e21838 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -1309,7 +1309,18 @@ ConnectionExists(struct Curl_easy *data,
         if(!ssh_config_matches(needle, check))
           continue;
       }
 -
 +#ifndef CURL_DISABLE_FTP
 +      if(needle->handler->protocol & (CURLPROTO_FTP|CURLPROTO_FTPS)) {
 +        /* Also match ACCOUNT, ALTERNATIVE-TO-USER, USE_SSL and CCC options */
 +        if(Curl_timestrcmp(needle->proto.ftpc.account,
 +                           check->proto.ftpc.account) ||
 +           Curl_timestrcmp(needle->proto.ftpc.alternative_to_user,
 +                           check->proto.ftpc.alternative_to_user) ||
 +           (needle->proto.ftpc.use_ssl != check->proto.ftpc.use_ssl) ||
 +           (needle->proto.ftpc.ccc != check->proto.ftpc.ccc))
 +          continue;
 +      }
 +#endif
       if(!needle->bits.httpproxy || (needle->handler->flags&PROTOPT_SSL) ||
          needle->bits.tunnel_proxy) {
         /* The requested connection does not use a HTTP proxy or it uses SSL or
 diff --git a/lib/urldata.h b/lib/urldata.h
 index 9d9ca92..4e2f5b9 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -1498,6 +1498,8 @@ struct UserDefined {
   curl_write_callback fwrite_header; /* function that stores headers */
   curl_write_callback fwrite_rtp;    /* function that stores interleaved RTP */
   curl_read_callback fread_func_set; /* function that reads the input */
 +  unsigned char use_ssl;   /* if AUTH TLS is to be attempted etc, for FTP or
 +                              IMAP or POP3 or others! (type: curl_usessl)*/
   int is_fread_set; /* boolean, has read callback been set to non-NULL? */
   int is_fwrite_set; /* boolean, has write callback been set to non-NULL? */
   curl_progress_callback fprogress; /* OLD and deprecated progress callback  */
@@ -1622,8 +1624,6 @@ struct UserDefined {
   bool ftp_use_eprt;     /* if EPRT is to be attempted or not */
   bool ftp_use_pret;     /* if PRET is to be used before PASV or not */
 -  curl_usessl use_ssl;   /* if AUTH TLS is to be attempted etc, for FTP or
 -                            IMAP or POP3 or others! */
   curl_ftpauth ftpsslauth; /* what AUTH XXX to be attempted */
   curl_ftpccc ftp_ccc;   /* FTP CCC options */
   bool no_signal;        /* do not use any signal/alarm handler */
 -- 
 2.39.2
--- a/SOURCES/0049-curl-7.61.1-CVE-2023-27536.patch
+++ b/SOURCES/0049-curl-7.61.1-CVE-2023-27536.patch
@ -1,55 +0,0 @@
 From 9d6dd7bc1dea42ae8e710aeae714e2a2c290de61 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Fri, 10 Mar 2023 09:22:43 +0100
 Subject: [PATCH] url: only reuse connections with same GSS delegation
 Reported-by: Harry Sintonen
 Closes #10731
 Upstream-commit: cb49e67303dbafbab1cebf4086e3ec15b7d56ee5
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/url.c     | 6 ++++++
 lib/urldata.h | 2 ++
 2 files changed, 8 insertions(+)
 diff --git a/lib/url.c b/lib/url.c
 index 3b11b7e..cbbc7f3 100644
 --- a/lib/url.c
 +++ b/lib/url.c
@@ -1305,6 +1305,11 @@ ConnectionExists(struct Curl_easy *data,
         }
       }
 +      /* GSS delegation differences do not actually affect every connection
 +         and auth method, but this check takes precaution before efficiency */
 +      if(needle->gssapi_delegation != check->gssapi_delegation)
 +        continue;
 +
       if(needle->handler->protocol & (CURLPROTO_SCP|CURLPROTO_SFTP)) {
         if(!ssh_config_matches(needle, check))
           continue;
@@ -1949,6 +1954,7 @@ static struct connectdata *allocate_conn(struct Curl_easy *data)
      it may live on without (this specific) Curl_easy */
   conn->fclosesocket = data->set.fclosesocket;
   conn->closesocket_client = data->set.closesocket_client;
 +  conn->gssapi_delegation = data->set.gssapi_delegation;
   return conn;
   error:
 diff --git a/lib/urldata.h b/lib/urldata.h
 index ce90304..9e16f26 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -856,6 +856,8 @@ struct connectdata {
   int httpversion;        /* the HTTP version*10 reported by the server */
   int rtspversion;        /* the RTSP version*10 reported by the server */
 +  unsigned char gssapi_delegation; /* inherited from set.gssapi_delegation */
 +
   struct curltime now;     /* "current" time */
   struct curltime created; /* creation time */
   curl_socket_t sock[2]; /* two sockets, the second is used for the data
 -- 
 2.39.2
--- a/SOURCES/0050-curl-7.61.1-sftp-upload-flags.patch
+++ b/SOURCES/0050-curl-7.61.1-sftp-upload-flags.patch
@ -1,34 +0,0 @@
 From cc52b2d89397ff26b01d791cd1c605cba741aaa4 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Felix=20H=C3=A4dicke?= <felixhaedicke@web.de>
 Date: Wed, 24 Jul 2019 11:47:51 +0200
 Subject: [PATCH] ssh-libssh: do not specify O_APPEND when not in append mode
 Specifying O_APPEND in conjunction with O_TRUNC and O_CREAT does not
 make much sense. And this combination of flags is not accepted by all
 SFTP servers (at least not Apache SSHD).
 Fixes #4147
 Closes #4148
 Upstream-commit: 62617495102c60124db8a909f592f063e38a89aa
 Signed-off-by: Kamil Dudka <kdudka@redhat.com>
 ---
 lib/ssh-libssh.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/lib/ssh-libssh.c b/lib/ssh-libssh.c
 index 4110be2..2414173 100644
 --- a/lib/ssh-libssh.c
 +++ b/lib/ssh-libssh.c
@@ -1112,7 +1112,7 @@ static CURLcode myssh_statemach_act(struct connectdata *conn, bool *block)
         flags = O_WRONLY|O_APPEND;
       else
         /* Clear file before writing (normal behaviour) */
 -        flags = O_WRONLY|O_APPEND|O_CREAT|O_TRUNC;
 +        flags = O_WRONLY|O_CREAT|O_TRUNC;
       if(sshc->sftp_file)
         sftp_close(sshc->sftp_file);
 -- 
 2.39.2
--- a/SOURCES/0051-curl-7.61.1-CVE-2023-28321.patch
+++ b/SOURCES/0051-curl-7.61.1-CVE-2023-28321.patch
@ -1,305 +0,0 @@
 From 199f2d440d8659b42670c1b796220792b01a97bf Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Mon, 24 Apr 2023 21:07:02 +0200
 Subject: [PATCH] hostcheck: fix host name wildcard checking
 The leftmost "label" of the host name can now only match against single
 '*'. Like the browsers have worked for a long time.
 - extended unit test 1397 for this
 - move some SOURCE variables from unit/Makefile.am to unit/Makefile.inc
 Reported-by: Hiroki Kurosawa
 Closes #11018
 ---
 lib/hostcheck.c         |  50 +++++++--------
 tests/data/test1397     |  10 ++-
 tests/unit/Makefile.am  |  94 ----------------------------
 tests/unit/Makefile.inc |  94 ++++++++++++++++++++++++++++
 tests/unit/unit1397.c   | 134 ++++++++++++++++++++++++----------------
 5 files changed, 202 insertions(+), 180 deletions(-)
 diff --git a/lib/hostcheck.c b/lib/hostcheck.c
 index e827dc58f378c..d061c6356f97f 100644
 --- a/lib/hostcheck.c
 +++ b/lib/hostcheck.c
@@ -43,6 +43,17 @@
 /* The last #include file should be: */
 #include "memdebug.h"
 +/* check the two input strings with given length, but do not
 +   assume they end in nul-bytes */
 +static int pmatch(const char *hostname, size_t hostlen,
 +                  const char *pattern, size_t patternlen)
 +{
 +  if(hostlen != patternlen)
 +    return CURL_HOST_NOMATCH;
 +  return strncasecompare(hostname, pattern, hostlen) ?
 +    CURL_HOST_MATCH : CURL_HOST_NOMATCH;
 +}
 +
 /*
  * Match a hostname against a wildcard pattern.
  * E.g.
@@ -65,26 +76,27 @@
 static int hostmatch(char *hostname, char *pattern)
 {
 -  const char *pattern_label_end, *pattern_wildcard, *hostname_label_end;
 -  int wildcard_enabled;
 -  size_t prefixlen, suffixlen;
 +  size_t hostlen, patternlen;
 +  const char *pattern_label_end;
   struct in_addr ignored;
 #ifdef ENABLE_IPV6
   struct sockaddr_in6 si6;
 #endif
 +  DEBUGASSERT(pattern);
 +  DEBUGASSERT(hostname);
 +
 +  hostlen = strlen(hostname);
 +  patternlen = strlen(pattern);
 +
   /* normalize pattern and hostname by stripping off trailing dots */
 -  size_t len = strlen(hostname);
 -  if(hostname[len-1]=='.')
 -    hostname[len-1] = 0;
 -  len = strlen(pattern);
 -  if(pattern[len-1]=='.')
 -    pattern[len-1] = 0;
 -
 -  pattern_wildcard = strchr(pattern, '*');
 -  if(pattern_wildcard == NULL)
 -    return strcasecompare(pattern, hostname) ?
 -      CURL_HOST_MATCH : CURL_HOST_NOMATCH;
 +  if(hostname[hostlen-1]=='.')
 +    hostname[hostlen-1] = 0;
 +  if(pattern[patternlen-1]=='.')
 +    pattern[patternlen-1] = 0;
 +
 +  if(strncmp(pattern, "*.", 2))
 +    return pmatch(hostname, hostlen, pattern, patternlen);
   /* detect IP address as hostname and fail the match if so */
   if(Curl_inet_pton(AF_INET, hostname, &ignored) > 0)
@@ -96,34 +108,20 @@ static int hostmatch(char *hostname, char *pattern)
   /* We require at least 2 dots in pattern to avoid too wide wildcard
      match. */
 -  wildcard_enabled = 1;
   pattern_label_end = strchr(pattern, '.');
 -  if(pattern_label_end == NULL || strchr(pattern_label_end + 1, '.') == NULL ||
 -     pattern_wildcard > pattern_label_end ||
 -     strncasecompare(pattern, "xn--", 4)) {
 -    wildcard_enabled = 0;
 +  if(pattern_label_end == NULL ||
 +    (strrchr(pattern, '.') == pattern_label_end))
 +      return pmatch(pattern, patternlen, hostname, hostlen);
 +
 +  const char *hostname_label_end = strchr(hostname, '.');
 +  if(hostname_label_end != NULL) {
 +    size_t skiphost = hostname_label_end - hostname;
 +    size_t skiplen = pattern_label_end - pattern;
 +    return pmatch(hostname_label_end, hostlen - skiphost,
 +                  pattern_label_end, patternlen - skiplen);
   }
 -  if(!wildcard_enabled)
 -    return strcasecompare(pattern, hostname) ?
 -      CURL_HOST_MATCH : CURL_HOST_NOMATCH;
 -
 -  hostname_label_end = strchr(hostname, '.');
 -  if(hostname_label_end == NULL ||
 -     !strcasecompare(pattern_label_end, hostname_label_end))
 -    return CURL_HOST_NOMATCH;
 -  /* The wildcard must match at least one character, so the left-most
 -     label of the hostname is at least as large as the left-most label
 -     of the pattern. */
 -  if(hostname_label_end - hostname < pattern_label_end - pattern)
 -    return CURL_HOST_NOMATCH;
 -
 -  prefixlen = pattern_wildcard - pattern;
 -  suffixlen = pattern_label_end - (pattern_wildcard + 1);
 -  return strncasecompare(pattern, hostname, prefixlen) &&
 -    strncasecompare(pattern_wildcard + 1, hostname_label_end - suffixlen,
 -                    suffixlen) ?
 -    CURL_HOST_MATCH : CURL_HOST_NOMATCH;
 +  return CURL_HOST_NOMATCH;
 }
 int Curl_cert_hostcheck(const char *match_pattern, const char *hostname)
 diff --git a/tests/data/test1397 b/tests/data/test1397
 index 84f962abebee3..f31b2c2a3f330 100644
 --- a/tests/data/test1397
 +++ b/tests/data/test1397
@@ -2,8 +2,7 @@
 <info>
 <keywords>
 unittest
 -ssl
 -wildcard
 +Curl_cert_hostcheck
 </keywords>
 </info>
@@ -15,10 +14,10 @@ none
 <features>
 unittest
 </features>
 - <name>
 -Check wildcard certificate matching function Curl_cert_hostcheck
 - </name>
 +<name>
 +Curl_cert_hostcheck unit tests
 +</name>
 <tool>
 unit1397
 </tool>
 </client>
 diff --git a/tests/unit/unit1397.c b/tests/unit/unit1397.c
 index 2f3d3aa4d09e1..3ae75618d5d10 100644
 --- a/tests/unit/unit1397.c
 +++ b/tests/unit/unit1397.c
@@ -21,8 +21,6 @@
  ***************************************************************************/
 #include "curlcheck.h"
 -#include "hostcheck.h" /* from the lib dir */
 -
 static CURLcode unit_setup(void)
 {
   return CURLE_OK;
@@ -30,50 +28,93 @@ static CURLcode unit_setup(void)
 static void unit_stop(void)
 {
 -  /* done before shutting down and exiting */
 }
 -UNITTEST_START
 -
 /* only these backends define the tested functions */
 -#if defined(USE_OPENSSL) || defined(USE_AXTLS) || defined(USE_GSKIT)
 -
 -  /* here you start doing things and checking that the results are good */
 +#if defined(USE_OPENSSL) || defined(USE_GSKIT) || defined(USE_SCHANNEL)
 +#include "hostcheck.h"
 +struct testcase {
 +  const char *host;
 +  const char *pattern;
 +  bool match;
 +};
 -fail_unless(Curl_cert_hostcheck("www.example.com", "www.example.com"),
 -            "good 1");
 -fail_unless(Curl_cert_hostcheck("*.example.com", "www.example.com"),
 -            "good 2");
 -fail_unless(Curl_cert_hostcheck("xxx*.example.com", "xxxwww.example.com"),
 -            "good 3");
 -fail_unless(Curl_cert_hostcheck("f*.example.com", "foo.example.com"),
 -            "good 4");
 -fail_unless(Curl_cert_hostcheck("192.168.0.0", "192.168.0.0"),
 -            "good 5");
 -
 -fail_if(Curl_cert_hostcheck("xxx.example.com", "www.example.com"), "bad 1");
 -fail_if(Curl_cert_hostcheck("*", "www.example.com"), "bad 2");
 -fail_if(Curl_cert_hostcheck("*.*.com", "www.example.com"), "bad 3");
 -fail_if(Curl_cert_hostcheck("*.example.com", "baa.foo.example.com"), "bad 4");
 -fail_if(Curl_cert_hostcheck("f*.example.com", "baa.example.com"), "bad 5");
 -fail_if(Curl_cert_hostcheck("*.com", "example.com"), "bad 6");
 -fail_if(Curl_cert_hostcheck("*fail.com", "example.com"), "bad 7");
 -fail_if(Curl_cert_hostcheck("*.example.", "www.example."), "bad 8");
 -fail_if(Curl_cert_hostcheck("*.example.", "www.example"), "bad 9");
 -fail_if(Curl_cert_hostcheck("", "www"), "bad 10");
 -fail_if(Curl_cert_hostcheck("*", "www"), "bad 11");
 -fail_if(Curl_cert_hostcheck("*.168.0.0", "192.168.0.0"), "bad 12");
 -fail_if(Curl_cert_hostcheck("www.example.com", "192.168.0.0"), "bad 13");
 -
 -#ifdef ENABLE_IPV6
 -fail_if(Curl_cert_hostcheck("*::3285:a9ff:fe46:b619",
 -                            "fe80::3285:a9ff:fe46:b619"), "bad 14");
 -fail_unless(Curl_cert_hostcheck("fe80::3285:a9ff:fe46:b619",
 -                                "fe80::3285:a9ff:fe46:b619"), "good 6");
 -#endif
 +static struct testcase tests[] = {
 +  {"", "", FALSE},
 +  {"a", "", FALSE},
 +  {"", "b", FALSE},
 +  {"a", "b", FALSE},
 +  {"aa", "bb", FALSE},
 +  {"\xff", "\xff", TRUE},
 +  {"aa.aa.aa", "aa.aa.bb", FALSE},
 +  {"aa.aa.aa", "aa.aa.aa", TRUE},
 +  {"aa.aa.aa", "*.aa.bb", FALSE},
 +  {"aa.aa.aa", "*.aa.aa", TRUE},
 +  {"192.168.0.1", "192.168.0.1", TRUE},
 +  {"192.168.0.1", "*.168.0.1", FALSE},
 +  {"192.168.0.1", "*.0.1", FALSE},
 +  {"h.ello", "*.ello", FALSE},
 +  {"h.ello.", "*.ello", FALSE},
 +  {"h.ello", "*.ello.", FALSE},
 +  {"h.e.llo", "*.e.llo", TRUE},
 +  {"h.e.llo", " *.e.llo", FALSE},
 +  {" h.e.llo", "*.e.llo", TRUE},
 +  {"h.e.llo.", "*.e.llo", TRUE},
 +  {"*.e.llo.", "*.e.llo", TRUE},
 +  {"************.e.llo.", "*.e.llo", TRUE},
 +  {"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
 +   "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
 +   "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
 +   "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
 +   "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
 +   ".e.llo.", "*.e.llo", TRUE},
 +  {"\xfe\xfe.e.llo.", "*.e.llo", TRUE},
 +  {"h.e.llo.", "*.e.llo.", TRUE},
 +  {"h.e.llo", "*.e.llo.", TRUE},
 +  {".h.e.llo", "*.e.llo.", FALSE},
 +  {"h.e.llo", "*.*.llo.", FALSE},
 +  {"h.e.llo", "h.*.llo", FALSE},
 +  {"h.e.llo", "h.e.*", FALSE},
 +  {"hello", "*.ello", FALSE},
 +  {"hello", "**llo", FALSE},
 +  {"bar.foo.example.com", "*.example.com", FALSE},
 +  {"foo.example.com", "*.example.com", TRUE},
 +  {"baz.example.net", "b*z.example.net", FALSE},
 +  {"foobaz.example.net", "*baz.example.net", FALSE},
 +  {"xn--l8j.example.local", "x*.example.local", FALSE},
 +  {"xn--l8j.example.net", "*.example.net", TRUE},
 +  {"xn--l8j.example.net", "*j.example.net", FALSE},
 +  {"xn--l8j.example.net", "xn--l8j.example.net", TRUE},
 +  {"xn--l8j.example.net", "xn--l8j.*.net", FALSE},
 +  {"xl8j.example.net", "*.example.net", TRUE},
 +  {"fe80::3285:a9ff:fe46:b619", "*::3285:a9ff:fe46:b619", FALSE},
 +  {"fe80::3285:a9ff:fe46:b619", "fe80::3285:a9ff:fe46:b619", TRUE},
 +  {NULL, NULL, FALSE}
 +};
 -#endif
 +UNITTEST_START
 +{
 +  int i;
 +  for(i = 0; tests[i].host; i++) {
 +    if(tests[i].match != Curl_cert_hostcheck(tests[i].pattern,
 +                                             strlen(tests[i].pattern),
 +                                             tests[i].host,
 +                                             strlen(tests[i].host))) {
 +      fprintf(stderr,
 +              "HOST: %s\n"
 +              "PTRN: %s\n"
 +              "did %sMATCH\n",
 +              tests[i].host,
 +              tests[i].pattern,
 +              tests[i].match ? "NOT ": "");
 +      unitfail++;
 +    }
 +  }
 +}
 +UNITTEST_STOP
 +#else
 -  /* you end the test code like this: */
 +UNITTEST_START
 UNITTEST_STOP
 +#endif
--- a/SOURCES/0052-curl-7.61.1-certs.patch
+++ b/SOURCES/0052-curl-7.61.1-certs.patch
--- a/SOURCES/0053-curl-7.61.1-password-when-keyboard-interactive-fails.patch
+++ b/SOURCES/0053-curl-7.61.1-password-when-keyboard-interactive-fails.patch
@ -1,169 +0,0 @@
 From be17dc9d31e805c03372b690dde67838b3bfc12d Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Wed, 24 May 2023 16:34:11 +0200
 Subject: [PATCH] libssh: when keyboard-interactive auth fails, try password
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The state machine had a mistake in that it would not carry on to that
 next step.
 This also adds a verbose output what methods that are available from the
 server and renames the macros that change to the next auth methods to
 try.
 Reported-by: 左潇峰
 Fixes #11196
 Closes #11197
 ---
 lib/ssh-libssh.c | 43 +++++++++++++++++++++++++++----------------
 1 file changed, 27 insertions(+), 16 deletions(-)
 diff --git a/lib/ssh-libssh.c b/lib/ssh-libssh.c
 index 7ebe61321419f..1cecb649cb623 100644
 --- a/lib/ssh-libssh.c
 +++ b/lib/ssh-libssh.c
@@ -442,7 +442,7 @@ static int myssh_is_known(struct Curl_easy *data)
   break; \
 }
 -#define MOVE_TO_LAST_AUTH \
 +#define MOVE_TO_PASSWD_AUTH \
   if(sshc->auth_methods & SSH_AUTH_METHOD_PASSWORD) { \
     rc = SSH_OK; \
     state(conn, SSH_AUTH_PASS_INIT); \
@@ -452,25 +452,25 @@ static int myssh_is_known(struct Curl_easy *data)
     MOVE_TO_ERROR_STATE(CURLE_LOGIN_DENIED); \
   }
 -#define MOVE_TO_TERTIARY_AUTH \
 +#define MOVE_TO_KEY_AUTH \
   if(sshc->auth_methods & SSH_AUTH_METHOD_INTERACTIVE) { \
     rc = SSH_OK; \
     state(conn, SSH_AUTH_KEY_INIT); \
     break; \
   } \
   else { \
 -    MOVE_TO_LAST_AUTH; \
 +    MOVE_TO_PASSWD_AUTH; \
   }
 -#define MOVE_TO_SECONDARY_AUTH \
 +#define MOVE_TO_GSSAPI_AUTH \
   if(sshc->auth_methods & SSH_AUTH_METHOD_GSSAPI_MIC) { \
     rc = SSH_OK; \
     state(conn, SSH_AUTH_GSSAPI); \
     break; \
   } \
   else { \
 -    MOVE_TO_TERTIARY_AUTH; \
 +    MOVE_TO_KEY_AUTH; \
   }
 static
 int myssh_auth_interactive(struct connectdata *conn)
@@ -617,6 +617,16 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
         }
         sshc->auth_methods = ssh_userauth_list(sshc->ssh_session, NULL);
 +        if(sshc->auth_methods)
 +          infof(data, "SSH authentication methods available: %s%s%s%s",
 +                sshc->auth_methods & SSH_AUTH_METHOD_PUBLICKEY ?
 +                "public key, ": "",
 +                sshc->auth_methods & SSH_AUTH_METHOD_GSSAPI_MIC ?
 +                "GSSAPI, " : "",
 +                sshc->auth_methods & SSH_AUTH_METHOD_INTERACTIVE ?
 +                "keyboard-interactive, " : "",
 +                sshc->auth_methods & SSH_AUTH_METHOD_PASSWORD ?
 +                "password": "");
         if(sshc->auth_methods & SSH_AUTH_METHOD_PUBLICKEY) {
           state(conn, SSH_AUTH_PKEY_INIT);
           infof(data, "Authentication using SSH public key file\n");
@@ -761,8 +761,8 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
       }
     case SSH_AUTH_PKEY_INIT:
       if(!(data->set.ssh_auth_types & CURLSSH_AUTH_PUBLICKEY)) {
 -        MOVE_TO_SECONDARY_AUTH;
 +        MOVE_TO_GSSAPI_AUTH;
       }
       /* Two choices, (1) private key was given on CMD,
        * (2) use the "default" keys. */
@@ -776,7 +776,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
           }
           if(rc != SSH_OK) {
 -            MOVE_TO_SECONDARY_AUTH;
 +            MOVE_TO_GSSAPI_AUTH;
           }
         }
@@ -826,7 +836,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
           break;
         }
 -        MOVE_TO_SECONDARY_AUTH;
 +        MOVE_TO_GSSAPI_AUTH;
       }
       break;
     case SSH_AUTH_PKEY:
@@ -828,13 +828,13 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
       }
       else {
         infof(data, "Failed public key authentication (rc: %d)\n", rc);
 -        MOVE_TO_SECONDARY_AUTH;
 +        MOVE_TO_GSSAPI_AUTH;
       }
       break;
     case SSH_AUTH_GSSAPI:
       if(!(data->set.ssh_auth_types & CURLSSH_AUTH_GSSAPI)) {
 -        MOVE_TO_TERTIARY_AUTH;
 +        MOVE_TO_KEY_AUTH;
       }
       rc = ssh_userauth_gssapi(sshc->ssh_session);
@@ -851,7 +851,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
         break;
       }
 -      MOVE_TO_TERTIARY_AUTH;
 +      MOVE_TO_KEY_AUTH;
       break;
     case SSH_AUTH_KEY_INIT:
@@ -736,13 +736,12 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
         state(conn, SSH_AUTH_KEY);
       }
       else {
 -        MOVE_TO_LAST_AUTH;
 +        MOVE_TO_PASSWD_AUTH;
       }
       break;
     case SSH_AUTH_KEY:
 -
 -      /* Authentication failed. Continue with keyboard-interactive now. */
 +      /* keyboard-interactive authentication */
       rc = myssh_auth_interactive(conn);
       if(rc == SSH_AGAIN) {
         break;
@@ -759,13 +759,15 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
       if(rc == SSH_OK) {
         sshc->authed = TRUE;
         infof(data, "completed keyboard interactive authentication\n");
 +        state(conn, SSH_AUTH_DONE);
 +      }
 +      else {
 +        MOVE_TO_PASSWD_AUTH;
       }
 -      state(conn, SSH_AUTH_DONE);
       break;
     case SSH_AUTH_PASS_INIT:
       if(!(data->set.ssh_auth_types & CURLSSH_AUTH_PASSWORD)) {
 -        /* Host key authentication is intentionally not implemented */
         MOVE_TO_ERROR_STATE(CURLE_LOGIN_DENIED);
       }
       state(conn, SSH_AUTH_PASS);
--- a/SOURCES/0054-curl-7.61.1-64K-sftp.patch
+++ b/SOURCES/0054-curl-7.61.1-64K-sftp.patch
@ -1,31 +0,0 @@
 From 35eb2614d86316ba9f5a6806ce64f56680fa1e97 Mon Sep 17 00:00:00 2001
 From: Jakub Jelen <jjelen@redhat.com>
 Date: Tue, 5 Sep 2023 17:33:41 +0200
 Subject: [PATCH] libssh: cap SFTP packet size sent
 Due to libssh limitations
 Signed-off-by: Jakub Jelen <jjelen@redhat.com>
 Closes #11804
 ---
 lib/ssh-libssh.c | 6 ++++++
 1 file changed, 6 insertions(+)
 diff --git a/lib/ssh-libssh.c b/lib/ssh-libssh.c
 index dea0084575859..7c6a2e53f338f 100644
 --- a/lib/ssh-libssh.c
 +++ b/lib/ssh-libssh.c
@@ -2412,6 +2412,12 @@ static ssize_t sftp_send(struct Curl_easy *data, int sockindex,
   ssize_t nwrite;
   (void)sockindex;
 +  /* limit the writes to the maximum specified in Section 3 of
 +   * https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-02
 +   */
 +  if(len > 32768)
 +    len = 32768;
 +
   nwrite = sftp_write(conn->proto.sshc.sftp_file, mem, len);
   myssh_block2waitfor(conn, FALSE);
--- a/SOURCES/0055-curl-7.61.1-CVE-2023-28322.patch
+++ b/SOURCES/0055-curl-7.61.1-CVE-2023-28322.patch
@ -1,388 +0,0 @@
 From 47f0d37bfc008c088416f3dcca802c9e087d9bf1 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Tue, 25 Apr 2023 08:28:01 +0200
 Subject: [PATCH] lib: unify the upload/method handling
 By making sure we set state.upload based on the set.method value and not
 independently as set.upload, we reduce confusion and mixup risks, both
 internally and externally.
 ---
 lib/curl_rtmp.c    | 4 ++--
 lib/file.c         | 4 ++--
 lib/ftp.c          | 8 ++++----
 lib/http.c         | 4 ++--
 lib/imap.c         | 6 +++---
 lib/rtsp.c         | 4 ++--
 lib/setopt.c       | 6 ++----
 lib/smb.c          | 6 +++---
 lib/smtp.c         | 4 ++--
 lib/tftp.c         | 8 ++++----
 lib/transfer.c     | 4 ++--
 lib/urldata.h      | 2 +-
 lib/ssh-libssh.c   | 6 +++---
 lib/ssh.c          | 6 +++---
 14 files changed, 36 insertions(+), 38 deletions(-)
 diff --git a/lib/curl_rtmp.c b/lib/curl_rtmp.c
 index 2679a2cdc1afe..406fb42ac0f44 100644
 --- a/lib/curl_rtmp.c
 +++ b/lib/curl_rtmp.c
@@ -231,7 +231,7 @@ static CURLcode rtmp_connect(struct Curl_easy *data, bool *done)
   /* We have to know if it's a write before we send the
    * connect request packet
    */
 -  if(conn->data->set.upload)
 +  if(conn->data->state.upload)
     r->Link.protocol |= RTMP_FEATURE_WRITE;
   /* For plain streams, use the buffer toggle trick to keep data flowing */
@@ -263,7 +263,7 @@ static CURLcode rtmp_do(struct Curl_easy *data, bool *done)
   if(!RTMP_ConnectStream(r, 0))
     return CURLE_FAILED_INIT;
 -  if(conn->data->set.upload) {
 +  if(conn->data->state.upload) {
     Curl_pgrsSetUploadSize(conn->data, conn->data->state.infilesize);
     Curl_setup_transfer(conn, -1, -1, FALSE, NULL, FIRSTSOCKET, NULL);
   }
 diff --git a/lib/file.c b/lib/file.c
 index 51c5d07ce40ab..c751e8861a99b 100644
 --- a/lib/file.c
 +++ b/lib/file.c
@@ -240,7 +240,7 @@ static CURLcode file_connect(struct Curl_easy *data, bool *done)
   file->freepath = real_path; /* free this when done */
   file->fd = fd;
 -  if(!data->set.upload && (fd == -1)) {
 +  if(!data->state.upload && (fd == -1)) {
     failf(data, "Couldn't open file %s", data->state.path);
     file_done(conn, CURLE_FILE_COULDNT_READ_FILE, FALSE);
     return CURLE_FILE_COULDNT_READ_FILE;
@@ -422,7 +422,7 @@ static CURLcode file_do(struct Curl_easy *data, bool *done)
   Curl_pgrsStartNow(data);
 -  if(data->set.upload)
 +  if(data->state.upload)
     return file_upload(conn);
   file = conn->data->req.protop;
 diff --git a/lib/ftp.c b/lib/ftp.c
 index f50d7baf622f8..4ff68cc454cbc 100644
 --- a/lib/ftp.c
 +++ b/lib/ftp.c
@@ -1381,7 +1381,7 @@ static CURLcode ftp_state_prepare_transfer(struct Curl_easy *data)
                 data->set.str[STRING_CUSTOMREQUEST]:
                 (data->set.ftp_list_only?"NLST":"LIST"));
       }
 -      else if(data->set.upload) {
 +      else if(data->state.upload) {
         PPSENDF(&conn->proto.ftpc.pp, "PRET STOR %s", conn->proto.ftpc.file);
       }
       else {
@@ -3368,7 +3368,7 @@ static CURLcode ftp_done(struct Curl_easy *data, CURLcode status,
     /* the response code from the transfer showed an error already so no
        use checking further */
     ;
 -  else if(data->set.upload) {
 +  else if(data->state.upload) {
     if((-1 != data->state.infilesize) &&
        (data->state.infilesize != *ftp->bytecountp) &&
        !data->set.crlf &&
@@ -3640,7 +3640,7 @@ static CURLcode ftp_do_more(struct Curl_easy *data, int *completep)
                            connected back to us */
       }
     }
 -    else if(data->set.upload) {
 +    else if(data->state.upload) {
       result = ftp_nb_type(conn, data->set.prefer_ascii, FTP_STOR_TYPE);
       if(result)
         return result;
@@ -4217,7 +4217,7 @@ CURLcode ftp_parse_url_path(struct Curl_easy *data)
     ftpc->file = NULL; /* instead of point to a zero byte, we make it a NULL
                           pointer */
 -  if(data->set.upload && !ftpc->file && (ftp->transfer == FTPTRANSFER_BODY)) {
 +  if(data->state.upload && !ftpc->file && (ftp->transfer == FTPTRANSFER_BODY)) {
     /* We need a file name when uploading. Return error! */
     failf(data, "Uploading to a URL without a file name!");
     return CURLE_URL_MALFORMAT;
 diff --git a/lib/http.c b/lib/http.c
 index 80e43f6f361e8..bffdd3468536d 100644
 --- a/lib/http.c
 +++ b/lib/http.c
@@ -2112,7 +2112,7 @@ void Curl_http_method(struct Curl_easy *data, struct connectdata *conn,
   http->writebytecount = http->readbytecount = 0;
   if((conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_FTP)) &&
 -     data->set.upload) {
 +     data->state.upload) {
     httpreq = HTTPREQ_PUT;
   }
@@ -2423,7 +2423,7 @@ CURLcode Curl_http_body(struct Curl_easy *data, struct connectdata *conn,
     if((conn->handler->protocol & PROTO_FAMILY_HTTP) &&
        (((httpreq == HTTPREQ_POST_MIME || httpreq == HTTPREQ_POST_FORM) &&
        http->postsize < 0) ||
 -       (data->set.upload && data->state.infilesize == -1))) {
 +       (data->state.upload && data->state.infilesize == -1))) {
       if(conn->bits.authneg)
         /* don't enable chunked during auth neg */
         ;
 diff --git a/lib/imap.c b/lib/imap.c
 index c2f675d4b2618..1952e66a1efcd 100644
 --- a/lib/imap.c
 +++ b/lib/imap.c
@@ -1511,10 +1511,10 @@ static CURLcode imap_done(struct Curl_easy *data, CURLcode status,
     result = status;         /* use the already set error code */
   }
   else if(!data->set.connect_only && !imap->custom &&
 -          (imap->uid || data->set.upload ||
 +          (imap->uid || data->state.upload ||
           data->set.mimepost.kind != MIMEKIND_NONE)) {
     /* Handle responses after FETCH or APPEND transfer has finished */
 -    if(!data->set.upload && data->set.mimepost.kind == MIMEKIND_NONE)
 +    if(!data->state.upload && data->set.mimepost.kind == MIMEKIND_NONE)
       state(conn, IMAP_FETCH_FINAL);
     else {
       /* End the APPEND command first by sending an empty line */
@@ -1581,7 +1581,7 @@ static CURLcode imap_perform(struct Curl_easy *data, bool *connected,
     selected = TRUE;
   /* Start the first command in the DO phase */
 -  if(conn->data->set.upload || data->set.mimepost.kind != MIMEKIND_NONE)
 +  if(conn->data->state.upload || data->set.mimepost.kind != MIMEKIND_NONE)
     /* APPEND can be executed directly */
     result = imap_perform_append(conn);
   else if(imap->custom && (selected || !imap->mailbox))
 index ea99d720ec4eb..ccd7264b00e74 100644
 --- a/lib/rtsp.c
 +++ b/lib/rtsp.c
@@ -493,7 +493,7 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
      rtspreq == RTSPREQ_SET_PARAMETER ||
      rtspreq == RTSPREQ_GET_PARAMETER) {
 -    if(data->set.upload) {
 +    if(data->state.upload) {
       putsize = data->state.infilesize;
       data->set.httpreq = HTTPREQ_PUT;
@@ -512,7 +512,7 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
       if(!Curl_checkheaders(conn, "Content-Length")) {
         result = Curl_add_bufferf(req_buffer,
             "Content-Length: %" CURL_FORMAT_CURL_OFF_T"\r\n",
 -            (data->set.upload ? putsize : postsize));
 +            (data->state.upload ? putsize : postsize));
         if(result)
           return result;
       }
 diff --git a/lib/setopt.c b/lib/setopt.c
 index 38f5711e44191..0c3b9634d1192 100644
 --- a/lib/setopt.c
 +++ b/lib/setopt.c
@@ -333,8 +333,8 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
      * We want to sent data to the remote host. If this is HTTP, that equals
      * using the PUT request.
      */
 -    data->set.upload = (0 != va_arg(param, long)) ? TRUE : FALSE;
 -    if(data->set.upload) {
 +    arg = va_arg(param, long);
 +    if(arg) {
       /* If this is HTTP, PUT is what's needed to "upload" */
       data->set.httpreq = HTTPREQ_PUT;
       data->set.opt_no_body = FALSE; /* this is implied */
@@ -888,7 +887,6 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
      */
     if(va_arg(param, long)) {
       data->set.httpreq = HTTPREQ_GET;
 -      data->set.upload = FALSE; /* switch off upload */
       data->set.opt_no_body = FALSE; /* this is implied */
     }
     break;
 diff --git a/lib/smb.c b/lib/smb.c
 index a1e444ee6b97e..d6822213529bc 100644
 --- a/lib/smb.c
 +++ b/lib/smb.c
@@ -530,7 +530,7 @@ static CURLcode smb_send_open(struct Curl_easy *data)
   byte_count = strlen(req->path);
   msg.name_length = smb_swap16((unsigned short)byte_count);
   msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
 -  if(conn->data->set.upload) {
 +  if(conn->data->state.upload) {
     msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
     msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
   }
@@ -813,7 +813,7 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
     smb_m = (const struct smb_nt_create_response*) msg;
     req->fid = smb_swap16(smb_m->fid);
     conn->data->req.offset = 0;
 -    if(conn->data->set.upload) {
 +    if(conn->data->state.upload) {
       conn->data->req.size = conn->data->state.infilesize;
       Curl_pgrsSetUploadSize(conn->data, conn->data->req.size);
       next_state = SMB_UPLOAD;
 diff --git a/lib/smtp.c b/lib/smtp.c
 index 7a030308d4689..c182cace742d7 100644
 --- a/lib/smtp.c
 +++ b/lib/smtp.c
@@ -1419,7 +1419,7 @@ static CURLcode smtp_done(struct Curl_easy *data, CURLcode status,
     result = status;         /* use the already set error code */
   }
   else if(!data->set.connect_only && data->set.mail_rcpt &&
 -          (data->set.upload || data->set.mimepost.kind)) {
 +          (data->state.upload || data->set.mimepost.kind)) {
     /* Calculate the EOB taking into account any terminating CRLF from the
        previous line of the email or the CRLF of the DATA command when there
        is "no mail data". RFC-5321, sect. 4.1.1.4.
@@ -1511,7 +1511,7 @@ static CURLcode smtp_perform(struct Curl_easy *data, bool *connected,
   smtp->eob = 2;
   /* Start the first command in the DO phase */
 -  if((data->set.upload || data->set.mimepost.kind) && data->set.mail_rcpt)
 +  if((data->state.upload || data->set.mimepost.kind) && data->set.mail_rcpt)
     /* MAIL transfer */
     result = smtp_perform_mail(conn);
   else
 diff --git a/lib/tftp.c b/lib/tftp.c
 index 164d3c723c5b9..8ed1b887b4d21 100644
 --- a/lib/tftp.c
 +++ b/lib/tftp.c
@@ -370,7 +370,7 @@ static CURLcode tftp_parse_option_ack(struct tftp_state_data *state,
       /* tsize should be ignored on upload: Who cares about the size of the
          remote file? */
 -      if(!data->set.upload) {
 +      if(!data->state.upload) {
         if(!tsize) {
           failf(data, "invalid tsize -:%s:- value in OACK packet", value);
           return CURLE_TFTP_ILLEGAL;
@@ -451,7 +451,7 @@ static CURLcode tftp_send_first(struct tftp_state_data *state,
       return result;
     }
 -    if(data->set.upload) {
 +    if(data->state.upload) {
       /* If we are uploading, send an WRQ */
       setpacketevent(&state->spacket, TFTP_EVENT_WRQ);
       state->conn->data->req.upload_fromhere =
@@ -486,7 +486,7 @@ static CURLcode tftp_send_first(struct tftp_state_data *state,
     if(!data->set.tftp_no_options) {
       char buf[64];
       /* add tsize option */
 -      if(data->set.upload && (data->state.infilesize != -1))
 +      if(data->state.upload && (data->state.infilesize != -1))
         snprintf(buf, sizeof(buf), "%" CURL_FORMAT_CURL_OFF_T,
                  data->state.infilesize);
       else
@@ -540,7 +540,7 @@ static CURLcode tftp_send_first(struct tftp_state_data *state,
     break;
   case TFTP_EVENT_OACK:
 -    if(data->set.upload) {
 +    if(data->state.upload) {
       result = tftp_connect_for_tx(state, event);
     }
     else {
 diff --git a/lib/transfer.c b/lib/transfer.c
 index e9ab8fbf09510..cb69f3365855a 100644
 --- a/lib/transfer.c
 +++ b/lib/transfer.c
@@ -1293,6 +1293,7 @@ void Curl_init_CONNECT(struct Curl_easy *data)
 {
   data->state.fread_func = data->set.fread_func_set;
   data->state.in = data->set.in_set;
 +  data->state.upload = (data->set.httpreq == HTTPREQ_PUT);
 }
 /*
@@ -1770,7 +1770,7 @@ CURLcode Curl_retry_request(struct Curl_easy *data, char **url)
   /* if we're talking upload, we can't do the checks below, unless the protocol
      is HTTP as when uploading over HTTP we will still get a response */
 -  if(data->set.upload &&
 +  if(data->state.upload &&
      !(conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_RTSP)))
     return CURLE_OK;
 diff --git a/lib/urldata.h b/lib/urldata.h
 index cca992a0295aa..a8580bdb66fe8 100644
 --- a/lib/urldata.h
 +++ b/lib/urldata.h
@@ -1494,6 +1494,7 @@ struct UrlState {
 #ifdef CURLDEBUG
   bool conncache_lock;
 #endif
 +  bool upload;         /* upload request */
 };
@@ -1838,7 +1839,6 @@ struct UserDefined {
   bool http_set_referer; /* is a custom referer used */
   bool http_auto_referer; /* set "correct" referer when following location: */
   bool opt_no_body;      /* as set with CURLOPT_NOBODY */
 -  bool upload;           /* upload request */
   enum CURL_NETRC_OPTION
        use_netrc;        /* defined in include/curl.h */
   bool verbose;          /* output verbosity */
 diff --git a/lib/ssh-libssh.c b/lib/ssh-libssh.c
 index b31f741ba9492..d60edaa303642 100644
 --- a/lib/ssh-libssh.c
 +++ b/lib/ssh-libssh.c
@@ -1209,7 +1209,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
     }
     case SSH_SFTP_TRANS_INIT:
 -      if(data->set.upload)
 +      if(data->state.upload)
         state(conn, SSH_SFTP_UPLOAD_INIT);
       else {
         if(protop->path[strlen(protop->path)-1] == '/')
@@ -1802,7 +1802,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
       /* Functions from the SCP subsystem cannot handle/return SSH_AGAIN */
       ssh_set_blocking(sshc->ssh_session, 1);
 -      if(data->set.upload) {
 +      if(data->state.upload) {
         if(data->state.infilesize < 0) {
           failf(data, "SCP requires a known file size for upload");
           sshc->actualcode = CURLE_UPLOAD_FAILED;
@@ -1907,7 +1907,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
         break;
       }
     case SSH_SCP_DONE:
 -      if(data->set.upload)
 +      if(data->state.upload)
         state(conn, SSH_SCP_SEND_EOF);
       else
         state(conn, SSH_SCP_CHANNEL_FREE);
 diff --git a/lib/ssh.c b/lib/ssh.c
 index f1154dc47a74e..f2e5352d1fd3a 100644
 --- a/lib/ssh.c
 +++ b/lib/ssh.c
@@ -2019,7 +2019,7 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block)
     }
     case SSH_SFTP_TRANS_INIT:
 -      if(data->set.upload)
 +      if(data->state.upload)
         state(conn, SSH_SFTP_UPLOAD_INIT);
       else {
         if(sftp_scp->path[strlen(sftp_scp->path)-1] == '/')
@@ -2691,7 +2691,7 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block)
         break;
       }
 -      if(data->set.upload) {
 +      if(data->state.upload) {
         if(data->state.infilesize < 0) {
           failf(data, "SCP requires a known file size for upload");
           sshc->actualcode = CURLE_UPLOAD_FAILED;
@@ -2831,7 +2831,7 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block)
     break;
     case SSH_SCP_DONE:
 -      if(data->set.upload)
 +      if(data->state.upload)
         state(conn, SSH_SCP_SEND_EOF);
       else
         state(conn, SSH_SCP_CHANNEL_FREE);
--- a/SOURCES/0056-curl-7.61.1-CVE-2023-38546.patch
+++ b/SOURCES/0056-curl-7.61.1-CVE-2023-38546.patch
@ -1,124 +0,0 @@
 From 61275672b46d9abb3285740467b882e22ed75da8 Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 14 Sep 2023 23:28:32 +0200
 Subject: [PATCH] cookie: remove unnecessary struct fields
 Plus: reduce the hash table size from 256 to 63. It seems unlikely to
 make much of a speed difference for most use cases but saves 1.5KB of
 data per instance.
 Closes #11862
 ---
 lib/cookie.c | 13 +------------
 lib/cookie.h | 13 ++++---------
 lib/easy.c   |  4 +---
 3 files changed, 6 insertions(+), 24 deletions(-)
 diff --git a/lib/cookie.c b/lib/cookie.c
 index 4345a84c6fd9d..e39c89a94a960 100644
 --- a/lib/cookie.c
 +++ b/lib/cookie.c
@@ -119,7 +119,6 @@ static void freecookie(struct Cookie *co)
   free(co->name);
   free(co->value);
   free(co->maxage);
 -  free(co->version);
   free(co);
 }
@@ -717,11 +716,7 @@ Curl_cookie_add(struct Curl_easy *data,
           }
         }
         else if(strcasecompare("version", name)) {
 -          strstore(&co->version, whatptr);
 -          if(!co->version) {
 -            badcookie = TRUE;
 -            break;
 -          }
 +          /* just ignore */
         }
         else if(strcasecompare("max-age", name)) {
           /* Defined in RFC2109:
@@ -1159,7 +1154,6 @@ Curl_cookie_add(struct Curl_easy *data,
         free(clist->path);
         free(clist->spath);
         free(clist->expirestr);
 -        free(clist->version);
         free(clist->maxage);
         *clist = *co;  /* then store all the new data */
@@ -1223,9 +1217,6 @@ struct CookieInfo *Curl_cookie_init(struct Curl_easy *data,
     c = calloc(1, sizeof(struct CookieInfo));
     if(!c)
       return NULL; /* failed to get memory */
 -    c->filename = strdup(file?file:"none"); /* copy the name just in case */
 -    if(!c->filename)
 -      goto fail; /* failed to get memory */
   }
   else {
     /* we got an already existing one, use that */
@@ -1378,7 +1369,6 @@ static struct Cookie *dup_cookie(struct Cookie *src)
     CLONE(name);
     CLONE(value);
     CLONE(maxage);
 -    CLONE(version);
     d->expires = src->expires;
     d->tailmatch = src->tailmatch;
     d->secure = src->secure;
@@ -1595,7 +1585,6 @@ void Curl_cookie_cleanup(struct CookieInfo *c)
 {
   if(c) {
     unsigned int i;
 -    free(c->filename);
     for(i = 0; i < COOKIE_HASH_SIZE; i++)
       Curl_cookie_freelist(c->cookies[i]);
     free(c); /* free the base struct as well */
 diff --git a/lib/cookie.h b/lib/cookie.h
 index b3c0063b2cfb2..41e9e7a6914e0 100644
 --- a/lib/cookie.h
 +++ b/lib/cookie.h
@@ -36,11 +36,7 @@ struct Cookie {
   curl_off_t expires;  /* expires = <this> */
   char *expirestr;   /* the plain text version */
   bool tailmatch;    /* whether we do tail-matching of the domain name */
 -
 -  /* RFC 2109 keywords. Version=1 means 2109-compliant cookie sending */
 -  char *version;     /* Version = <value> */
   char *maxage;      /* Max-Age = <value> */
 -
   bool secure;       /* whether the 'secure' keyword was used */
   bool livecookie;   /* updated from a server, not a stored file */
   bool httponly;     /* true if the httponly directive is present */
@@ -56,15 +52,14 @@ struct Cookie {
   int creationtime;  /* time when the cookie was written */
 };
 -#define COOKIE_HASH_SIZE 256
 +#define COOKIE_HASH_SIZE 63
 struct CookieInfo {
   /* linked list of cookies we know of */
   struct Cookie *cookies[COOKIE_HASH_SIZE];
 -  char *filename;  /* file we read from/write to */
   bool running;    /* state info, for cookie adding information */
 -  long numcookies; /* number of cookies in the "jar" */
 +  int numcookies; /* number of cookies in the "jar" */
   bool newsession; /* new session, discard session cookies on load */
   int lastct;      /* last creation-time used in the jar */
 };
 diff --git a/lib/easy.c b/lib/easy.c
 index 16bbd35251d40..03195481f9780 100644
 --- a/lib/easy.c
 +++ b/lib/easy.c
@@ -925,9 +925,7 @@ struct Curl_easy *curl_easy_duphandle(struct Curl_easy *data)
   if(data->cookies) {
     /* If cookies are enabled in the parent handle, we enable them
        in the clone as well! */
 -    outcurl->cookies = Curl_cookie_init(data,
 -                                        data->cookies->filename,
 -                                        outcurl->cookies,
 +    outcurl->cookies = Curl_cookie_init(data, NULL, outcurl->cookies,
                                         data->set.cookiesession);
     if(!outcurl->cookies)
       goto fail;
--- a/SOURCES/0057-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch
+++ b/SOURCES/0057-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch
@ -1,193 +0,0 @@
 diff -up curl-7.61.1/lib/http2.c.25a25f45 curl-7.61.1/lib/http2.c
 --- curl-7.61.1/lib/http2.c.25a25f45	2023-08-07 14:03:42.043463284 +0200
 +++ curl-7.61.1/lib/http2.c	2023-08-07 14:10:24.769489855 +0200
@@ -1202,7 +1202,7 @@ CURLcode Curl_http2_request_upgrade(Curl
   binlen = nghttp2_pack_settings_payload(binsettings, H2_BINSETTINGS_LEN,
                                          httpc->local_settings,
                                          httpc->local_settings_num);
 -  if(!binlen) {
 +  if(binlen <= 0) {
     failf(conn->data, "nghttp2 unexpectedly failed on pack_settings_payload");
     Curl_add_buffer_free(req);
     return CURLE_FAILED_INIT;
@@ -1285,6 +1285,14 @@ static int h2_process_pending_input(stru
     return -1;
   }
 +  if(nghttp2_session_check_request_allowed(httpc->h2) == 0) {
 +    /* No more requests are allowed in the current session, so
 +       the connection may not be reused. This is set when a
 +       GOAWAY frame has been received or when the limit of stream
 +       identifiers has been reached. */
 +    connclose(conn, "http/2: No new requests allowed");
 +  }
 +
   if(should_close_session(httpc)) {
     H2BUGF(infof(data,
                  "h2_process_pending_input: nothing to do in this session\n"));
@@ -1297,7 +1305,6 @@ static int h2_process_pending_input(stru
     }
     return -1;
   }
 -
   return 0;
 }
@@ -1455,8 +1462,6 @@ static int h2_session_send(struct Curl_e
 static ssize_t http2_recv(struct connectdata *conn, int sockindex,
                           char *mem, size_t len, CURLcode *err)
 {
 -  CURLcode result = CURLE_OK;
 -  ssize_t rv;
   ssize_t nread;
   struct http_conn *httpc = &conn->proto.httpc;
   struct Curl_easy *data = conn->data;
@@ -1519,8 +1524,7 @@ static ssize_t http2_recv(struct connect
       /* We have paused nghttp2, but we have no pause data (see
          on_data_chunk_recv). */
       httpc->pause_stream_id = 0;
 -      if(h2_process_pending_input(conn, httpc, &result) != 0) {
 -        *err = result;
 +      if(h2_process_pending_input(conn, httpc, err) != 0) {
         return -1;
       }
     }
@@ -1549,8 +1553,7 @@ static ssize_t http2_recv(struct connect
          frames, then we have to call it again with 0-length data.
          Without this, on_stream_close callback will not be called,
          and stream could be hanged. */
 -      if(h2_process_pending_input(conn, httpc, &result) != 0) {
 -        *err = result;
 +      if(h2_process_pending_input(conn, httpc, err) != 0) {
         return -1;
       }
     }
@@ -1573,7 +1576,6 @@ static ssize_t http2_recv(struct connect
     return -1;
   }
   else {
 -    char *inbuf;
     /* remember where to store incoming data for this stream and how big the
        buffer is */
     stream->mem = mem;
@@ -1582,16 +1584,15 @@ static ssize_t http2_recv(struct connect
     if(httpc->inbuflen == 0) {
       nread = ((Curl_recv *)httpc->recv_underlying)(
 -          conn, FIRSTSOCKET, httpc->inbuf, H2_BUFSIZE, &result);
 +          conn, FIRSTSOCKET, httpc->inbuf, H2_BUFSIZE, err);
       if(nread == -1) {
 -        if(result != CURLE_AGAIN)
 +        if(*err != CURLE_AGAIN)
           failf(data, "Failed receiving HTTP2 data");
         else if(stream->closed)
           /* received when the stream was already closed! */
           return http2_handle_stream_close(conn, data, stream, err);
 -        *err = result;
         return -1;
       }
@@ -1604,47 +1605,17 @@ static ssize_t http2_recv(struct connect
       H2BUGF(infof(data, "nread=%zd\n", nread));
       httpc->inbuflen = nread;
 -      inbuf = httpc->inbuf;
 +
 +      DEBUGASSERT(httpc->nread_inbuf == 0);
     }
     else {
       nread = httpc->inbuflen - httpc->nread_inbuf;
 -      inbuf = httpc->inbuf + httpc->nread_inbuf;
 -
 +      (void)nread;  /* silence warning, used in debug */
       H2BUGF(infof(data, "Use data left in connection buffer, nread=%zd\n",
                    nread));
     }
 -    rv = nghttp2_session_mem_recv(httpc->h2, (const uint8_t *)inbuf, nread);
 -
 -    if(nghttp2_is_fatal((int)rv)) {
 -      failf(data, "nghttp2_session_mem_recv() returned %zd:%s\n",
 -            rv, nghttp2_strerror((int)rv));
 -      *err = CURLE_RECV_ERROR;
 -      return -1;
 -    }
 -    H2BUGF(infof(data, "nghttp2_session_mem_recv() returns %zd\n", rv));
 -    if(nread == rv) {
 -      H2BUGF(infof(data, "All data in connection buffer processed\n"));
 -      httpc->inbuflen = 0;
 -      httpc->nread_inbuf = 0;
 -    }
 -    else {
 -      httpc->nread_inbuf += rv;
 -      H2BUGF(infof(data, "%zu bytes left in connection buffer\n",
 -                   httpc->inbuflen - httpc->nread_inbuf));
 -    }
 -    /* Always send pending frames in nghttp2 session, because
 -       nghttp2_session_mem_recv() may queue new frame */
 -    rv = h2_session_send(data, httpc->h2);
 -    if(rv != 0) {
 -      *err = CURLE_SEND_ERROR;
 -      return -1;
 -    }
 -
 -    if(should_close_session(httpc)) {
 -      H2BUGF(infof(data, "http2_recv: nothing to do in this session\n"));
 -      *err = CURLE_HTTP2;
 +    if(h2_process_pending_input(conn, httpc, err) != 0)
       return -1;
 -    }
   }
   if(stream->memlen) {
     ssize_t retlen = stream->memlen;
@@ -2108,7 +2079,6 @@ CURLcode Curl_http2_switched(struct conn
   CURLcode result;
   struct http_conn *httpc = &conn->proto.httpc;
   int rv;
 -  ssize_t nproc;
   struct Curl_easy *data = conn->data;
   struct HTTP *stream = conn->data->req.protop;
@@ -2186,39 +2156,10 @@ CURLcode Curl_http2_switched(struct conn
     memcpy(httpc->inbuf, mem, nread);
   httpc->inbuflen = nread;
 -  nproc = nghttp2_session_mem_recv(httpc->h2, (const uint8_t *)httpc->inbuf,
 -                                   httpc->inbuflen);
 +  DEBUGASSERT(httpc->nread_inbuf == 0);
 -  if(nghttp2_is_fatal((int)nproc)) {
 -    failf(data, "nghttp2_session_mem_recv() failed: %s(%d)",
 -          nghttp2_strerror((int)nproc), (int)nproc);
 +  if(-1 == h2_process_pending_input(conn, httpc, &result))
     return CURLE_HTTP2;
 -  }
 -
 -  H2BUGF(infof(data, "nghttp2_session_mem_recv() returns %zd\n", nproc));
 -
 -  if((ssize_t)nread == nproc) {
 -    httpc->inbuflen = 0;
 -    httpc->nread_inbuf = 0;
 -  }
 -  else {
 -    httpc->nread_inbuf += nproc;
 -  }
 -
 -  /* Try to send some frames since we may read SETTINGS already. */
 -  rv = h2_session_send(data, httpc->h2);
 -
 -  if(rv != 0) {
 -    failf(data, "nghttp2_session_send() failed: %s(%d)",
 -          nghttp2_strerror(rv), rv);
 -    return CURLE_HTTP2;
 -  }
 -
 -  if(should_close_session(httpc)) {
 -    H2BUGF(infof(data,
 -                 "nghttp2_session_send(): nothing to do in this session\n"));
 -    return CURLE_HTTP2;
 -  }
   return CURLE_OK;
 }
--- a/SOURCES/0058-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch
+++ b/SOURCES/0058-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch
@ -1,15 +0,0 @@
 diff -up curl-7.61.1/lib/http2.c.c1b6a384 curl-7.61.1/lib/http2.c
 --- curl-7.61.1/lib/http2.c.c1b6a384	2023-08-07 13:59:18.482137005 +0200
 +++ curl-7.61.1/lib/http2.c	2023-08-07 14:03:42.043463284 +0200
@@ -1467,6 +1467,11 @@ static ssize_t http2_recv(struct connect
   if(should_close_session(httpc)) {
     H2BUGF(infof(data,
                  "http2_recv: nothing to do in this session\n"));
 +    if(conn->bits.close) {
 +      /* already marked for closure, return OK and we're done */
 +      *err = CURLE_OK;
 +      return 0;
 +    }
     *err = CURLE_HTTP2;
     return -1;
   }
--- a/SOURCES/0059-curl-7.61.1-CVE-2023-46218.patch
+++ b/SOURCES/0059-curl-7.61.1-CVE-2023-46218.patch
@ -1,48 +0,0 @@
 From 2b0994c29a721c91c572cff7808c572a24d251eb Mon Sep 17 00:00:00 2001
 From: Daniel Stenberg <daniel@haxx.se>
 Date: Thu, 23 Nov 2023 08:15:47 +0100
 Subject: [PATCH] cookie: lowercase the domain names before PSL checks
 Reported-by: Harry Sintonen
 Closes #12387
 ---
 lib/cookie.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)
 diff --git a/lib/cookie.c b/lib/cookie.c
 index 568cf537ad1b1f..9095cea3e97f22 100644
 --- a/lib/cookie.c
 +++ b/lib/cookie.c
@@ -1027,15 +1027,23 @@ Curl_cookie_add(struct Curl_easy *data,
 #ifdef USE_LIBPSL
   /* Check if the domain is a Public Suffix and if yes, ignore the cookie. */
   if(domain && co->domain && !isip(co->domain)) {
 -    const psl_ctx_t *psl = Curl_psl_use(data);
 -    int acceptable;
 -
 -    if(psl) {
 -      acceptable = psl_is_cookie_domain_acceptable(psl, domain, co->domain);
 -      Curl_psl_release(data);
 +    bool acceptable = FALSE;
 +    char lcase[256];
 +    char lcookie[256];
 +    size_t dlen = strlen(domain);
 +    size_t clen = strlen(co->domain);
 +    if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) {
 +      const psl_ctx_t *psl = Curl_psl_use(data);
 +      if(psl) {
 +        /* the PSL check requires lowercase domain name and pattern */
 +        Curl_strntolower(lcase, domain, dlen + 1);
 +        Curl_strntolower(lcookie, co->domain, clen + 1);
 +        acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie);
 +        Curl_psl_release(data);
 +      }
 +      else
 +        acceptable = !bad_domain(domain);
     }
 -    else
 -      acceptable = !bad_domain(domain);
     if(!acceptable) {
       infof(data, "cookie '%s' dropped, domain '%s' must not "
--- a/SOURCES/0060-curl-7.61.1-lowercase-headernames.patch
+++ b/SOURCES/0060-curl-7.61.1-lowercase-headernames.patch
@ -1,136 +0,0 @@
 From 0023fce38d3bd6ee0e9b6ff8708fee1195057846 Mon Sep 17 00:00:00 2001
 From: Barry Pollard <barry_pollard@hotmail.com>
 Date: Sun, 22 Sep 2019 21:17:12 +0100
 Subject: [PATCH] http: lowercase headernames for HTTP/2 and HTTP/3
 Closes #4401
 Fixes #4400
 ---
 lib/strcase.c      | 84 ++++++++++++++++++++++++++++++++++++++++++++++
 lib/strcase.h      |  2 ++
 5 files changed, 95 insertions(+), 3 deletions(-)
 diff --git a/lib/strcase.c b/lib/strcase.c
 index 24bcca932..098cec7a8 100644
 --- a/lib/strcase.c
 +++ b/lib/strcase.c
@@ -93,6 +93,75 @@ char Curl_raw_toupper(char in)
   return in;
 }
 +
 +/* Portable, consistent tolower (remember EBCDIC). Do not use tolower() because
 +   its behavior is altered by the current locale. */
 +char Curl_raw_tolower(char in)
 +{
 +#if !defined(CURL_DOES_CONVERSIONS)
 +  if(in >= 'A' && in <= 'Z')
 +    return (char)('a' + in - 'A');
 +#else
 +  switch(in) {
 +  case 'A':
 +    return 'a';
 +  case 'B':
 +    return 'b';
 +  case 'C':
 +    return 'c';
 +  case 'D':
 +    return 'd';
 +  case 'E':
 +    return 'e';
 +  case 'F':
 +    return 'f';
 +  case 'G':
 +    return 'g';
 +  case 'H':
 +    return 'h';
 +  case 'I':
 +    return 'i';
 +  case 'J':
 +    return 'j';
 +  case 'K':
 +    return 'k';
 +  case 'L':
 +    return 'l';
 +  case 'M':
 +    return 'm';
 +  case 'N':
 +    return 'n';
 +  case 'O':
 +    return 'o';
 +  case 'P':
 +    return 'p';
 +  case 'Q':
 +    return 'q';
 +  case 'R':
 +    return 'r';
 +  case 'S':
 +    return 's';
 +  case 'T':
 +    return 't';
 +  case 'U':
 +    return 'u';
 +  case 'V':
 +    return 'v';
 +  case 'W':
 +    return 'w';
 +  case 'X':
 +    return 'X';
 +  case 'Y':
 +    return 'y';
 +  case 'Z':
 +    return 'z';
 +  }
 +#endif
 +
 +  return in;
 +}
 +
 +
 /*
  * Curl_strcasecompare() is for doing "raw" case insensitive strings. This is
  * meant to be locale independent and only compare strings we know are safe
@@ -234,6 +303,21 @@ void Curl_strntoupper(char *dest, const char *src, size_t n)
   } while(*src++ && --n);
 }
 +/* Copy a lower case version of the string from src to dest.  The
 + * strings may overlap.  No more than n characters of the string are copied
 + * (including any NUL) and the destination string will NOT be
 + * NUL-terminated if that limit is reached.
 + */
 +void Curl_strntolower(char *dest, const char *src, size_t n)
 +{
 +  if(n < 1)
 +    return;
 +
 +  do {
 +    *dest++ = Curl_raw_tolower(*src);
 +  } while(*src++ && --n);
 +}
 +
 /* Compare case-sensitive NUL-terminated strings, taking care of possible
  * null pointers. Return true if arguments match.
  */
 diff --git a/lib/strcase.h b/lib/strcase.h
 index 6fee3840e..2f07a74c9 100644
 --- a/lib/strcase.h
 +++ b/lib/strcase.h
@@ -40,12 +40,14 @@ int Curl_safe_strcasecompare(const char *first, const char *second);
 int Curl_strncasecompare(const char *first, const char *second, size_t max);
 char Curl_raw_toupper(char in);
 +char Curl_raw_tolower(char in);
 /* checkprefix() is a shorter version of the above, used when the first
    argument is zero-byte terminated */
 #define checkprefix(a,b)    curl_strnequal(a,b,strlen(a))
 void Curl_strntoupper(char *dest, const char *src, size_t n);
 +void Curl_strntolower(char *dest, const char *src, size_t n);
 bool Curl_safecmp(char *a, char *b);
 int Curl_timestrcmp(const char *first, const char *second);
 -- 
 2.43.0
--- a/SOURCES/0061-curl-7.61.1-CVE-2024-2398.patch
+++ b/SOURCES/0061-curl-7.61.1-CVE-2024-2398.patch
@ -1,80 +0,0 @@
 From deca8039991886a559b67bcd6701db800a5cf764 Mon Sep 17 00:00:00 2001
 From: Stefan Eissing <stefan@eissing.org>
 Date: Wed, 6 Mar 2024 09:36:08 +0100
 Subject: [PATCH] http2: push headers better cleanup
 - provide common cleanup method for push headers
 Closes #13054
 ---
 lib/http2.c | 34 +++++++++++++++-------------------
 1 file changed, 15 insertions(+), 19 deletions(-)
 diff --git a/lib/http2.c b/lib/http2.c
 index c63ecd38371ab4..96868728a53a1f 100644
 --- a/lib/http2.c
 +++ b/lib/http2.c
@@ -271,6 +271,15 @@ static CURLcode http2_data_setup(struct Curl_cfilter *cf,
   return http2_perform_getsock(conn, sock, numsocks);
 }
 +static void free_push_headers(struct HTTP *http)
 +{
 +  size_t i;
 +  for(i = 0; i<http->push_headers_used; i++)
 +    free(http->push_headers[i]);
 +  Curl_safefree(http->push_headers);
 +  http->push_headers_used = 0;
 +}
 +
 /*
  * http2_stream_free() free HTTP2 stream related data
  */
@@ -306,11 +315,7 @@ static void http2_data_done(struct Curl_cfilter *cf,
     http->header_recvbuf = NULL; /* clear the pointer */
     Curl_add_buffer_free(http->trailer_recvbuf);
     http->trailer_recvbuf = NULL; /* clear the pointer */
 -    for(; http->push_headers_used > 0; --http->push_headers_used) {
 -      free(http->push_headers[http->push_headers_used - 1]);
 -    }
 -    free(http->push_headers);
 -    http->push_headers = NULL;
 +    free_push_headers(http);
   }
 }
@@ -860,7 +861,6 @@ static int push_promise(struct Curl_cfilter *cf,
     struct curl_pushheaders heads;
     CURLMcode rc;
     struct http_conn *httpc;
 -    size_t i;
     /* clone the parent */
     struct Curl_easy *newhandle = duphandle(data);
     if(!newhandle) {
@@ -904,11 +904,7 @@ static int push_promise(struct Curl_cfilter *cf,
     Curl_set_in_callback(data, false);
     /* free the headers again */
 -    for(i = 0; i<stream->push_headers_used; i++)
 -      free(stream->push_headers[i]);
 -    free(stream->push_headers);
 -    stream->push_headers = NULL;
 -    stream->push_headers_used = 0;
 +    free_push_headers(stream);
     if(rv) {
       /* denied, kill off the new handle again */
@@ -1426,10 +1422,10 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
             stream->push_headers_alloc) {
       char **headp;
       stream->push_headers_alloc *= 2;
 -      headp = Curl_saferealloc(stream->push_headers,
 -                               stream->push_headers_alloc * sizeof(char *));
 +      headp = realloc(stream->push_headers,
 +                      stream->push_headers_alloc * sizeof(char *));
       if(!headp) {
 -        stream->push_headers = NULL;
 +        free_push_headers(stream);
         return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
       }
       stream->push_headers = headp;
--- a/SPECS/curl.spec
+++ b/SPECS/curl.spec
@ -1,7 +1,7 @@
 Summary: A utility for getting files from remote servers (FTP, HTTP, and others)
 Name: curl
 Version: 7.61.1
-Release: 34%{?dist}.2
+Release: 22%{?dist}
 License: MIT
 Source: https://curl.haxx.se/download/%{name}-%{version}.tar.xz
@ -100,84 +100,6 @@ Patch34:  0034-curl-7.61.1-CVE-2021-22946.patch
 # fix STARTTLS protocol injection via MITM (CVE-2021-22947)
 Patch35:  0035-curl-7.61.1-CVE-2021-22947.patch
 # fix OAUTH2 bearer bypass in connection re-use (CVE-2022-22576)
 Patch36:  0036-curl-7.61.1-CVE-2022-22576.patch
 # fix auth/cookie leak on redirect (CVE-2022-27776)
 Patch37:  0037-curl-7.61.1-CVE-2022-27776.patch
 # fix credential leak on redirect (CVE-2022-27774)
 Patch38:  0038-curl-7.61.1-CVE-2022-27774.patch
 # fix too eager reuse of TLS and SSH connections (CVE-2022-27782)
 Patch39:  0039-curl-7.61.1-CVE-2022-27782.patch
 # fix FTP-KRB bad message verification (CVE-2022-32208)
 Patch40:  0040-curl-7.61.1-CVE-2022-32208.patch
 # fix HTTP compression denial of service (CVE-2022-32206)
 Patch41:  0041-curl-7.61.1-CVE-2022-32206.patch
 # setopt: enable CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION (#2063703)
 Patch42:  0042-curl-7.61.1-ssh-known-hosts.patch
 # control code in cookie denial of service (CVE-2022-35252)
 Patch43:  0043-curl-7.61.1-CVE-2022-35252.patch
 # upon HTTP_1_1_REQUIRED, retry the request with HTTP/1.1 (#2139337)
 Patch44:  0044-curl-7.61.1-retry-http11.patch
 # smb/telnet: fix use-after-free when HTTP proxy denies tunnel (CVE-2022-43552)
 Patch45:  0045-curl-7.61.1-CVE-2022-43552.patch
 # h2: lower initial window size to 32 MiB (#2166254)
 Patch46:  0046-curl-7.61.1-h2-window-size.patch
 # fix HTTP multi-header compression denial of service (CVE-2023-23916)
 Patch47:  0047-curl-7.61.1-CVE-2023-23916.patch
 # fix FTP too eager connection reuse (CVE-2023-27535)
 Patch48:  0048-curl-7.61.1-CVE-2023-27535.patch
 # fix GSS delegation too eager connection re-use (CVE-2023-27536)
 Patch49:  0049-curl-7.61.1-CVE-2023-27536.patch
 # sftp: do not specify O_APPEND when not in append mode (#2187717)
 Patch50:  0050-curl-7.61.1-sftp-upload-flags.patch
 # fix host name wildcard checking (CVE-2023-28321)
 Patch51:  0051-curl-7.61.1-CVE-2023-28321.patch
 # rebuild certs with 2048-bit RSA keys
 Patch52:  0052-curl-7.61.1-certs.patch
 # when keyboard-interactive auth fails, try password
 Patch53:  0053-curl-7.61.1-password-when-keyboard-interactive-fails.patch
 # cap SFTP packet size sent
 Patch54:  0054-curl-7.61.1-64K-sftp.patch
 # unify the upload/method handling (CVE-2023-28322)
 Patch55:  0055-curl-7.61.1-CVE-2023-28322.patch
 # fix cookie injection with none file (CVE-2023-38546)
 Patch56:  0056-curl-7.61.1-CVE-2023-38546.patch
 # consolidate nghttp2_session_mem_recv() call paths
 Patch57:  0057-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch
 # when marked for closure and wanted to close == OK
 Patch58:  0058-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch
 # lowercase the domain names before PSL checks (CVE-2023-46218)
 Patch59:  0059-curl-7.61.1-CVE-2023-46218.patch
 # lowercase headernames
 Patch60:  0060-curl-7.61.1-lowercase-headernames.patch
 # provide common cleanup method for push headers (CVE-2024-2398)
 Patch61:  0061-curl-7.61.1-CVE-2024-2398.patch
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
@ -383,35 +305,6 @@ sed -e 's|%%HTTPPORT|%{?__isa_bits}90|g' -i tests/data/test1448
 %patch33 -p1
 %patch34 -p1
 %patch35 -p1
 %patch36 -p1
 %patch37 -p1
 %patch38 -p1
 sed -e 's|:8992/|:%{?__isa_bits}92/|g' -i tests/data/test97{3..6}
 %patch39 -p1
 %patch40 -p1
 %patch41 -p1
 %patch42 -p1
 %patch43 -p1
 %patch44 -p1
 %patch45 -p1
 %patch46 -p1
 %patch47 -p1
 %patch48 -p1
 %patch49 -p1
 %patch50 -p1
 %patch51 -p1
 git apply %{PATCH52}
 %patch53 -p1
 %patch54 -p1
 %patch55 -p1
 %patch56 -p1
 %patch57 -p1
 %patch58 -p1
 %patch59 -p1
 %patch60 -p1
 %patch61 -p1
 # make tests/*.py use Python 3
 sed -e '1 s|^#!/.*python|#!%{__python3}|' -i tests/*.py
@ -574,60 +467,6 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
 %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal
 %changelog
 * Wed Aug 14 2024 Jacek Migacz <jmigacz@redhat.com> - 7.61.1-34.el8_10.2
 - provide common cleanup method for push headers (CVE-2024-2398)
 * Tue Jun 25 2024 Jacek Migacz <jmigacz@redhat.com> - 7.61.1-34.el8_10.1
 - fix incorrect backport of bz2229800 (RHEL-44684)
 * Tue Sep 19 2023 Jacek Migacz <jmigacz@redhat.com> - 7.61.1-34
 - when keyboard-interactive auth fails, try password (#2229800)
 - cap SFTP packet size sent (RHEL-5311)
 - unify the upload/method handling (CVE-2023-28322)
 - fix cookie injection with none file (CVE-2023-38546)
 - fix HTTP2 connection failure with HTTP2 framing layer (RHEL-5657)
 - lowercase the domain names before PSL checks (CVE-2023-46218)
 * Tue Jun 27 2023 Jacek Migacz <jmigacz@redhat.com> - 7.61.1-33
 - fix host name wildcard checking (CVE-2023-28321)
 - rebuild certs with 2048-bit RSA keys
 * Thu Apr 20 2023 Kamil Dudka <kdudka@redhat.com> - 7.61.1-32
 - sftp: do not specify O_APPEND when not in append mode (#2187717)
 * Fri Mar 24 2023 Kamil Dudka <kdudka@redhat.com> - 7.61.1-31
 - fix GSS delegation too eager connection re-use (CVE-2023-27536)
 - fix FTP too eager connection reuse (CVE-2023-27535)
 * Wed Feb 15 2023 Kamil Dudka <kdudka@redhat.com> - 7.61.1-30
 - fix HTTP multi-header compression denial of service (CVE-2023-23916)
 * Tue Feb 07 2023 Kamil Dudka <kdudka@redhat.com> - 7.61.1-29
 - h2: lower initial window size to 32 MiB (#2166254)
 * Wed Dec 21 2022 Kamil Dudka <kdudka@redhat.com> - 7.61.1-28
 - smb/telnet: fix use-after-free when HTTP proxy denies tunnel (CVE-2022-43552)
 * Fri Nov 18 2022 Kamil Dudka <kdudka@redhat.com> - 7.61.1-27
 - upon HTTP_1_1_REQUIRED, retry the request with HTTP/1.1 (#2139337)
 * Fri Sep 02 2022 Kamil Dudka <kdudka@redhat.com> - 7.61.1-26
 - control code in cookie denial of service (CVE-2022-35252)
 * Wed Jun 29 2022 Kamil Dudka <kdudka@redhat.com> - 7.61.1-25
 - setopt: enable CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION (#2063703)
 - fix HTTP compression denial of service (CVE-2022-32206)
 - fix FTP-KRB bad message verification (CVE-2022-32208)
 * Wed May 11 2022 Kamil Dudka <kdudka@redhat.com> - 7.61.1-24
 - fix too eager reuse of TLS and SSH connections (CVE-2022-27782)
 - fix invalid type in printf() argument detected by Coverity
 * Thu Apr 28 2022 Kamil Dudka <kdudka@redhat.com> - 7.61.1-23
 - fix credential leak on redirect (CVE-2022-27774)
 - fix auth/cookie leak on redirect (CVE-2022-27776)
 - fix OAUTH2 bearer bypass in connection re-use (CVE-2022-22576)
 * Fri Sep 17 2021 Kamil Dudka <kdudka@redhat.com> - 7.61.1-22
 - fix STARTTLS protocol injection via MITM (CVE-2021-22947)
 - fix protocol downgrade required TLS bypass (CVE-2021-22946)